Hi,
I am trying to configure our ASA 5510. For now we just want to replace our old PIX with the ASA, security will come later.
This is why I just want to allow everything to go through the ASA.
We use two interfaces on the ASA, 0 is the outside interface, where we will connect the cable from our ISP, and 1 is the inside interface, where we will connect our switch. I have enabled intra-interfaces communications.
Our topology is like this: we have a PIX in front, a pool of public IPs that we NAT to servers behind the PIX. I have used the ASDM to configure the NAT, I got this configuration:
object network web1_ext
host 194.206.163.34
object network web2_ext
host 194.206.163.35
object network web3_ext
host 194.206.163.36
object network web1_int
host 192.168.192.34
object network web2_int
host 192.168.192.35
object network web3_int
host 192.168.192.36
object network web1_ext
nat (any,any) static web1_int
object network web2_ext
nat (any,any) static web2_int
object network web3_ext
nat (any,any) static web3_int
object network web1_int
nat (any,any) static web1_ext
object network web2_int
nat (any,any) static web2_ext
object network web3_int
nat (any,any) static web3_ext
Then, I added some access rules via the ASDM, on both interfaces (inside and outside), and on global, with source any, destination any, service ip.
The rules were:
access-list inside_access_in extended permit ip any any
access-list outside_access_in extended permit ip any any
access-list global_access extended permit ip any any
And:
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
access-group global_access global
I expected this to let all the traffic through the ASA, but it didn't work. I checked the command reference for access-list extended, there is this example:
hostname(config)# access-list ACL_IN extended permit ip any any
The description of the example says: "The following access list allows all hosts (on the interface to which you apply the access list) to go
through the adaptive security appliance"
I'm not a native english speaker, but I understand that this would do what I want. So what is the problem with the two rules above ?
Now, I changed the rules, using the All object-group, with allows any port on TCP-UDP, and added a rule for ICMP, which works for me, but I'd still like to know what is wrong with my rules.
Thanks in advance.
