Hello all,
I am stumped.
Here is my scrubbed config. I hope I didn't leave out anything useful.
interface Vlan100
nameif inside
security-level 100
ip address 10.0.0.1 255.255.0.0
no shutdown
interface Vlan200
nameif outside
security-level 0
ip address 1.2.3.4 255.255.255.0
no shutdown
interface Vlan300
nameif voip
security-level 50
ip address 192.168.0.1 255.255.255.0
no shutdown
interface Vlan400
nameif wlan
security-level 50
ip address 172.16.0.1 255.255.255.0
no shutdown
global (outside) 1 interface
global (outside) 2 1.2.3.9
global (outside) 3 1.2.3.10
global (outside) 4 interface
global (voip) 4 interface
global (wlan) 4 interface
nat (inside) 0 access-list no_nat
nat (inside) 1 10.0.0.0 255.255.0.0
nat (voip) 2 192.168.0.0 255.255.255.0
nat (wlan) 3 172.16.0.0 255.255.255.0
nat (inside) 4 10.0.1.0 255.255.255.0
What I am after: I want voip and wlan to be on there own and only be able to go to internet (with their own external IP) and not talk to eachother or inside. The exception is that I want 10.0.1.0/24 (management range) to be able to talk to wlan and voip.
The problem: With the configuration as shown above, I acheive everything I need except for 10.0.1.0/24 reports "portmap translation creation failed for tcp src inside:10.0.1.13/1076 dst outside:1.2.2.2/443" when trying to move through the outside interface (the internet).
If I swap ID's 1 and 4 then 10.0.1.0/24 works perfectly, it can talk to all 3 segments, but the rest of the 10.0.0.0/16 range displays the portmap translation errors in the asdm real-time log viewer when trying to access the internet (outside interface).
I feel like I am very close to my desired configuration, but I can't figure out how to solve this problem.
ASA5505
Cisco Adaptive Security Appliance Software Version 8.2(2)
Device Manager Version 6.3(1)
Thanks a bunch for stopping by.
