Hi everyone,
I have just updated a PIX 525 from software version 6x to 8x.
I have a question on how PDM in version 6x automatically converted access-lists so they worked with outside NAT addresses ? but in version 8x (using ASDM) this is not the case. This is causing me a major headache!
So previously in version 6x:
I created a NAT rule in PDM to translate the internal IP to external:
Inside server IP - 192.168.1.1
Outside NAT IP - 206.45.18.189
Resulting in:
static (inside,outside) 206.45.18.189 192.168.1.1 netmask 255.255.255.255
I then created a new access rule in PDM to permit traffic from the outside to 192.168.1.1 on the inside for any host.
The resulting access-list visible in the config is:
access-list outside_access_in extended permit ip any host 206.45.18.189
Note how PDM has taken the inside address I specified and replaced it with the valid outside NAT address. This worked a treat!
Unfortunately in version 8 using with ASDM - if you permit access to an inside address from the outside ? even if a valid (inside,outside) NAT rule is in place ? you get this this in the config:
access-list outside_access_in extended permit ip any host 192.168.1.1
It seems something major has changed! I have also noticed version 6x created "reference" groups if you allowed access to an inside network "object-group":
For example ? your permit access to an inside group:
object-group network INSIDE-SERVERS
network-object 192.168.1.1
network-object 192.168.1.2
network-object 192.168.1.3
And PDM automatically creates a "reference" (_ref) group that uses the valid outside NAT addresses:
object-group network INSIDE-SERVERS_ref
network-object 206.45.18.189
network-object 206.45.18.190
network-object 206.45.18.191
The group ending in "_ref" is the one used in inbound access-lists.
Version 6 really did work its magic ? has this useful "feature" disappeared in version 8x?
Many thanks for your time,
Paul
