topic Problems with ASA 5520 in Network Security

Problems with ASA 5520

nachete1979 — Wed, 13 Mar 2019 00:53:05 GMT

Hello all,

I am having dificulties migrating from a PIX to an ASA 5520 8.0(3).

I have the nat translations of the DMZs servers and the access list in the outside interface as see below:

access-list outside_access_in extended permit tcp any host FTP range ftp-data ftp

static (DMZ,outside) x.y.z.a FTP netmask 255.255.255.255

But when i try to connect to the outside natted address, the log says that the connection is denied due to the access list.

when I try a sh nat DMZ FTP, it says:

match ip DMZ host FTP outside any

static translation to x.y.z.a

translate_hits = 0, untranslate_hits = 52

It seems it is not being translated

Any ideas?

acomiskey — Thu, 20 Dec 2007 16:25:43 GMT

access-list outside_access_in extended permit tcp any host FTP range ftp-data ftp

should be...

access-list outside_access_in extended permit tcp any host x.y.z.a range ftp-data ftp

nachete1979 — Fri, 21 Dec 2007 10:02:46 GMT

Then, my question is, does the ASA work in a different way than the PIX regarding access-list?

I mean, does pix do first nat and later control and asa vice versa?

acomiskey — Fri, 21 Dec 2007 14:10:10 GMT

No, they work the same way.