Hi All,
We have an ASA 5525-X (v9.1(7) with ASDM 7.1(3)) and what I'm trying to achieve is relatively simple (at least it should be) but struggling and trying to work out whether the ASA is missing some config or something else in our security stack is causing problems by process or elimination.
I have a 3rd party cloud solution (on 123.123.123.123) which needs to send logs inbound through our ASA to a log collector on our LAN. The log collector is NAT'd on our ASA and the port on the outside interface (tcp 7000) translates to a different port internally (tcp 514). I've set the NAT and an ACL up as follows with ASDM:
(Note all addresses are examples!)
- Created network object - inside address of 192.168.1.100, selected NAT "automatic address translation rules" and used a static of 193.186.1.100, clicked the "Advanced" tab and ensured the Source Interface is the "inside", and Destination is the "outside". For the service I've set protocol to "tcp", Real port to "514" and Mapped port to "7000"
- I've then created an ACL on the outside interface with the following:
- Source: 123.123.123.123
- Destination: NAT'd object 192.168.1.100 / 193.186.1.100
- Service: tcp/7000 and tcp/514
The hit counter is going up on the rule when I use the test connection from the cloud provider, however 3 way H-S doesn't seem to fully complete. Logs on the inside log collector are showing the SYN & SYN-ACK work, but the ACK seems to have SEW flags.
Any help would be greatly appreciated.
Cheers
