Nagios Server inside Cisco ASA5510 Monitoring on outside interface

[Lee Murphy]

Need some advice/help on a firewall issue. Not sure this is the forum I should be in, but anyhow this is the issue: I got a Linux box hosting Nagios that is on the inside interface of a Cisco ASA5510. The Windows boxes I monitor are on the outside interface of the same Cisco ASA5510. I have no problem with Nagios communicating with the Windows servers as traffic is passed from the inside to outside on the 5510. The problem I am having is Nagios "Cannot fetch information from the server" to receive the resource information such as, C:\ Drive Space, CPU Load, Memory Usage, etc. In other words the firewall is blocking the outside interface from coming inside.

[David Castro F.]

Hello Lee Murphy,

This is a default behavior of the ASA from Outside interfaces(Would have a Security level of 0) and the Inside Security level of 0, so by default the ASA cannot allow Lower to Higher communication, it allows from higher to lower and the response back is allowed. If the traffic is initiating from the outside you will need to define an inbound ACL (Access group) applied to the outside interface allowing the communication such as:

access-list Outside-inbound permit ip XXXXXXX YYYYYYYYY

access-group Outside-inbound in interface Outside 

XXXXXXXX -- Outside Hosts such as the Windows Boxes IP addresses

YYYYYYY '-- Linux Nagios Box IP¨address

Keep me posted, please proceed to rate and mark as correct the helpful post!

David Castro,