05-15-2011 04:56 PM - edited 03-11-2019 01:33 PM
ASA outside 192.168.1.50/24, outside gateway is 192.168.1.1.
inside 10.0.0.1
host 10.0.0.10
I am trying to map this host to an IP that is not currently used, 192.168.1.57.
but it is not working, debugging of ping from inside host to the gateway shows as follow, any idea?
======================
ICMP echo request translating inside:10.0.0.10 to outside:192.168.1.57
ICMP echo request from inside:10.0.0.10 to outside:192.168.1.101 ID=63745 seq=1 len=56
ICMP echo request translating inside:10.0.0.10 to outside:192.168.1.57
ICMP echo request from inside:10.0.0.10 to outside:192.168.1.101 ID=63745 seq=2 len=56
================
interface Vlan1
nameif inside
security-level 100
ip address 10.0.0.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 192.168.1.50 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
object network my-host-obj1
nat (inside,outside) static my-mapped-obj
access-group 101 in interface outside
route outside 0.0.0.0 0.0.0.0 192.168.1.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 10.0.0.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
service-policy global_policy global
prompt hostname context
Solved! Go to Solution.
05-15-2011 10:29 PM
Han,
This format is not at all readable
"
Ijust put these two commands. I also have incoming ACL on the outside interface.
R==(outside 192.168.1.0/24)==ASA====Inside(10.0.0.X/24)
It is wild. from inside network, a computer, I CAN ping Router's interface which is the gatewate. But I cannot ping another PCon the same subet of the router's interface. Icannot ping ASA's outside interface which is 199.168.1.50. from the ASA Ican ping the PC.
thanks,
Han
Could you post your reply again.
Thanks,
Varun
05-15-2011 08:43 PM
Hi Han,
This should be the statement,
object network Natted_ip
host 192.168.1.5
object network host_ip
host 10.0.0.10
nat (inside,outside) static Natted_ip
Alongwith the natting you should have an Acl as well.
access-list outside_access_in extended permit ip any host 10.0.0.10
access-group outside_access_in in interface outside
icmp permit any inside
icmp permit any outside
this should work for you.
Thanks,
Varun
05-15-2011 10:06 PM
icmp permit any inside
icmp permit any outside
Ijust put these two commands. I also have incoming ACL on the outside interface.
R==(outside 192.168.1.0/24)==ASA====Inside(10.0.0.X/24)
It is wild. from inside network, a computer, I CAN ping Router's interface which is the gatewate. But I cannot ping another PCon the same subet of the router's interface. Icannot ping ASA's outside interface which is 199.168.1.50. from the ASA Ican ping the PC.
thanks,
Han
05-15-2011 10:29 PM
Han,
This format is not at all readable
"
Ijust put these two commands. I also have incoming ACL on the outside interface.
R==(outside 192.168.1.0/24)==ASA====Inside(10.0.0.X/24)
It is wild. from inside network, a computer, I CAN ping Router's interface which is the gatewate. But I cannot ping another PCon the same subet of the router's interface. Icannot ping ASA's outside interface which is 199.168.1.50. from the ASA Ican ping the PC.
thanks,
Han
Could you post your reply again.
Thanks,
Varun
05-17-2011 03:50 PM
Varun,
Never mind, I got it.
thanks,
Han
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide