I'm trying to configure an ASA 5520 with cut-through proxy feature. The user is required to be authenticated when trying to access an outside resource from the inside. This is a test lab before it is implemented in production. Following is the configuration -
ciscoasa# sh run
: Saved
:
ASA Version 8.3(1)
!
hostname ciscoasa
enable password 2KFQnbNIdI.2KYOU encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface GigabitEthernet0/0
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/1
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/2
nameif inside
security-level 100
ip address 192.168.50.254 255.255.255.0
!
interface GigabitEthernet0/3
nameif outside
security-level 0
ip address 192.168.100.254 255.255.255.0
!
interface Management0/0
nameif management
security-level 100
ip address 192.168.200.254 255.255.255.0
management-only
!
boot system disk0:/asa831-k8.bin
ftp mode passive
object network InternalLAN
subnet 192.168.50.0 255.255.255.0
object network obj_any
subnet 0.0.0.0 0.0.0.0
access-list inside_access_in extended permit tcp object InternalLAN any eq www
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu management 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-631.bin
no asdm history enable
arp timeout 14400
!
object network obj_any
nat (inside,outside) dynamic interface
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 192.168.100.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:03:00 absolute uauth 0:02:00 inactivity
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication match inside_access_in inside LOCAL
aaa proxy-limit 128
aaa local authentication attempts max-fail 3
aaa authentication listener http inside port www redirect
http server enable
http server session-timeout 15
http 192.168.200.0 255.255.255.0 management
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
auth-prompt prompt THIS IS A TEST LOGON PAGE
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
username test password P4ttSyrm33SV8TYp encrypted
username admin password f3UhLvUj1QsXsuK7 encrypted!!prompt hostname context
<snip>Cryptochecksum:ce425897ddd74c003034d095e4a2c2d9
: end
ciscoasa#
From the laptop I can ping the Inside interface and vice-versa.
I'm obviously missing a key element here so would really appreciate if someone can point it out.
