Hi guys
its been a while since ive worked on an ASA and never on 8.4
Ive set up the ASA so i can access(From my office) some devices behind the inside interface (at the DC) this works fine- so nat is working fine and ACL's are ok as well.... the problem I'm having is trying to access a server on SSH from the same Office but behind the DMZ interface. i really am finding it hard with this nat statements ... ,my config is below and any help would be appreciated.
ASA Version 8.4(3)
!
hostname FW
domain-name xx.local
names
!
interface Ethernet0/0
switchport access vlan 200
!
interface Ethernet0/1
switchport access vlan 100
!
interface Ethernet0/2
description OOBSW:F0/7
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
nameif OOBDMZ
security-level 50
ip address 172.17.2.125 255.255.255.128
!
interface Vlan100
description INSIDE INT
nameif inside
security-level 100
ip address 172.18.1.253 255.255.255.0
!
interface Vlan200
nameif outside
security-level 0
ip address x.x.x.x 255.255.255.x
!
ftp mode passive
clock timezone GMT 1
dns server-group DefaultDNS
domain-name xx.local
object network OOBTS1
host 172.18.1.250
object network OOBTS2
host 172.18.1.251
object network OFFICE
host x.x.x.141
object network MNGMNTSRVR
host 172.17.2.73
object network MNGMNTSRVRPUBLIC
host x.x.x.x.x
object-group network SUPPLIERSIP
description SUPP IP's
network-object host 3.3.3.3
network-object host 2.2.2.2
network-object host 1.1.1.1
access-list outside_in extended permit tcp object OFFICE host 172.18.1.250 eq 2001
access-list outside_in extended permit tcp object OFFICE host 172.18.1.250 eq telnet
access-list outside_in extended permit tcp host x.x.x.x host 172.17.2.73 eq ssh
access-list outside_in extended deny ip any any
access-list dmz_in extended permit ip object MNGMNTSRVR object OFFICE
pager lines 24
logging enable
logging timestamp
logging buffer-size 91218
logging buffered debugging
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu OOBDMZ 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
nat (OOBDMZ,outside) source dynamic MNGMNTSRVR MNGMNTSRVRPUBLIC destination static OFFICE OFFICE
!
object network OOBTS1
nat (inside,outside) static x.x.x.60
object network OOBTS2
nat (inside,outside) static x.x.x.61
object network MNGMNTSRVR
nat (OOBDMZ,outside) static x.x.x.56
access-group outside_in in interface outside
access-group dmz_in in interface OOBDMZ
route outside 0.0.0.0 0.0.0.0 x.x.x.1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
telnet timeout 5
ssh OFFICE 255.255.255.255 outside
ssh 172.18.1.0 255.255.255.0 inside
ssh timeout 5
ssh version 2
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
!
!
prompt hostname context
no call-home reporting anonymous
password encryption aes
Cryptochecksum:7434b79b1af3df10cd9b3bfaa22ae40d
: end
FW#
thanks
Sol
