08-28-2015 06:00 PM - edited 03-11-2019 11:30 PM
Good Evening,
I have been going crazy trying to get this working. I have a subnet of external IPs 1xx.xx.xx.104 255.255.255.248.
Services as follows:
Cable Modem Router is .105.
ASA 5505 .106
WWW/FTP .107
Exchange SMTP/EWS .108
ADFS .110
Internal Web/FTP 192.168.1.218
Internal Exchange: 192.168.1.225
ADFS in DMZ: 192.168.30.50
Internal ADFS: 192.168.1.50
VLANs work internally. I can get out to the internet just fine. I just cannot access any of my servers from external devices. I've tried looking at the logs and I cannot decipher them
I have attached my config for review. I cannot get to the Exchange Server OWA. SMTP does not work. Cannot get to the IIS web page either. All from external sources. I need ADFS in the DMZ to be the proxy and have access to the Internal ADFS Server. I figure it is NAT and/or my access lists that are not configured properly.
PLEASE HELP!!!!
Thanks,
Lance the Novice
Solved! Go to Solution.
08-28-2015 07:04 PM
Lance,
the only thing I can see in the config that doesn't look quite right are your service objects. FTP for example
object service FTP service tcp source eq ftp destination eq ftp description Protocol for FTP
You have both the source and destination ports eq FTP
If you are connecting to the ftp server then the destination port is FTP, but the source can be anything.
I would change your service objects just to have the destination set as below
object service FTP service tcp destination eq ftp description Protocol for FTP
HTH
Richard.
08-28-2015 07:04 PM
Lance,
the only thing I can see in the config that doesn't look quite right are your service objects. FTP for example
object service FTP service tcp source eq ftp destination eq ftp description Protocol for FTP
You have both the source and destination ports eq FTP
If you are connecting to the ftp server then the destination port is FTP, but the source can be anything.
I would change your service objects just to have the destination set as below
object service FTP service tcp destination eq ftp description Protocol for FTP
HTH
Richard.
08-28-2015 07:36 PM
HTH,
I changed those like you said and still no luck.
I can ping 106 (address of the asa), but cannot ping any of the other IPs in the range except the Cable Router .105
I'm really about to give up on this. Hopefully my support contract # will come in soon and I can get TAC on it.
Thanks for your help. I appreciate any help I can get at this point.
Lance
08-28-2015 08:17 PM
UPDATE UPDATE UPDATE
When the cable company installed the modem, they did not set it to bridge across the IP range. Once I told the cable router to bridge the WAN addresses, everything started working!
Thanks again for all your help. I am leaving those statements that you told me to put in there.
WOOHOO!
Lance
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide