ASA 5510 9.1.5 Can not access Web Server from external SYC timeout

[Chris Hott]

We recently upgraded our ASA from 8.2.5 to 9.1.5

since that upgrade all of our features except our NAT are working correctly

we have a 62.67.81.x / 255.255.255.240 subnet

We have several web servers behind the firewall and we can't access any of them from the internet.

We've followed the guides for setting up new NAT with ver 9.1.5

and the packet tracer works, but watching the logging, it would appear that the TCP 3 way handshake is timing out.

Any suggestions or thoughts?

[joseoroz]

Hello Chris,

Have you setup captures on the internal interface?

https://supportforums.cisco.com/document/69281/asa-using-packet-capture-troubleshoot-asa-firewall-configuration-and-scenarios

If you have confirmed that the traffic should be allowed across the firewall and you see the traffic failing for timeout then you need to determine if there is a reply coming from the internal server.

Regards,

Jose Orozco.

[Vibhor Amrodia]

Hi,

Are you seeing the packet trace working correctly ? Can you paste the output on this post ?

Thanks and Regards,

Vibhor Amrodia

[Andre Neethling]

Can you share your NAT config and ACL config for the servers you are having issues with?