Denied Traffic

[fasteddye]

We have a put an ASA5505 between us and vendor.  There are only a couple of servers that sit behind this ASA5505 that will talk to vendor.  We have a link setup to the vendor using the outside interface with a 10.10.2.x/30.

The inside network is 10.10.190.x/24.  There is a NAT setup to translate a server on the inside 10.10.190.241 to 10.100.1.140.

static (inside,outside) 10.100.1.140 10.10.190.241 netmask 255.255.255.255.

The server address us 10.10.190.240, so the source is 10.10.190.240 and destination is 10.10.190.241.

We are getting the following in log when the inside server attempts to connect.

Inbound TCP connection denied from 10.10.190.240/3405 to 10.10.190.241/85 flags SYN  on interface inside.

I believe we have the correct routes in place and that it may be an acl issue.

I have not added any acls other than what is standard on an asa5505 out of the box.

I have also tried adding the following thinking they would open up all traffic.

access-list outside_access_in extended permit ip any any
access-list inside_access_in extended permit ip any any

Thanks.

[fasteddye]

Made all config recommendations and still receive the following in log

2 Oct 18 2010 22:04:32  10.10.190.240 1444 10.10.190.241 85 Inbound TCP connection denied from 10.10.190.240/1444 to 10.10.190.241/85 flags SYN  on interface inside

i have attached updated config.

[Maykol Rojas]

Hi,

You put one of the statics wrong, it is not

static (inside,outside) 10.10.190.241 10.100.1.140 netmask 255.255.255.255

It is

static (outside,inside) 10.10.190.241 10.100.1.140 netmask 255.255.255.255

Try that and let us know, I will be waiting for the inputs.

Mike

[fasteddye]

Sorry for the mess up there.

It looks like traffic is going through now. The web interface is not pulling up, but that could be vendor side. The vendor mentioned once we get traffic flowing from our side they may need to adjust their side.

I do see a route failed in log along with built and teardown.

Is route failed something to be concerned with?

6 Oct 18 2010 22:18:34 10.10.190.240 1554 10.100.1.140 85 Built inbound TCP connection 4004 for inside:10.10.190.240/1554 (10.10.190.240/1554) to outside:10.100.1.140/85 (10.10.190.241/85)

6 Oct 18 2010 22:18:34 10.10.190.240 1554 10.100.1.140 85 Routing failed to locate next hop for TCP from inside:10.10.190.240/1554 to outside:10.100.1.140/85

6 Oct 18 2010 22:18:34 10.10.190.240 1554 10.100.1.140 85 Teardown TCP connection 4004 for inside:10.10.190.240/1554 to outside:10.100.1.140/85 duration 0:00:00 bytes 0 No valid adjacency

[Maykol Rojas]

Hello,

Yes it is, and that may be the reason why you are not able to see the page.

I see that you have a host route to get to the 10.100.1.140 via 10.10.2.193 which is on the inside.... I am assuming this is incorrect...

route inside 10.100.1.140 255.255.255.255 10.10.2.193 1

The packet should be routed to the outside instead of the inside

Can you take that route out and put the correct route to get to that server on the vendor side?

Will be waiting

Mike

[fasteddye]

Wow, got it working.

I had to change static route entry from inside to outside 10.100.1.140 255.255.255.255 10.10.2.194.

Just got your response that mentioned you had noticed the static route was incorrect.

When launching url from inside server now pulls up.

Thanks so much for your hard work. I could not have done this without help.

-Ed

[Maykol Rojas]

Hello Ed!!!!

YAY!!!!!!!!!! Excellent, nothing that a cup of coffee and the Yankees game cant solve

I am glad that everything is working...

Cheers!!

Mike

[Maykol Rojas]

Hello Ed,

If everything is working fine, would you mind placing this post as resolved?

Cheers.

Mike