Upgrading from a PIX 515 ,V6.2,
I can get internet traffic out through the ASA , but no traffic in to the servers. The NATS are the same on the old firewall.
The routers outside the firewalls are doing further natting from the .253 netwrok to a publilc address. No changes have taken place on the routers.
I believe there is something simple I am missing
ASA Version 8.2(1)
!
names
name 172.17.1.14 Lotus
name 172.17.1.0 Inside-VLAN1
name 172.17.2.0 Inside-VLAN2
name 172.17.3.0 Inside-VLAN3
!
interface Vlan1
nameif inside
security-level 100
ip address 172.17.1.50 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 172.17.253.22 255.255.255.0
!
interface Vlan5
no nameif
security-level 50
no ip address
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
clock timezone CST -6
clock summer-time CDT recurring
object-group service Citrix udp
description Old ICA Browsing
port-object eq 1604
object-group service DM_INLINE_TCP_0 tcp
port-object eq lotusnotes
port-object eq smtp
object-group service Agile tcp
description Agile ports
port-object eq 8009
port-object eq 8010
object-group service DM_INLINE_TCP_1 tcp
port-object eq 5800
port-object eq 5900
port-object eq 8009
port-object eq 8010
object-group service DM_INLINE_SERVICE_1
service-object tcp eq 2598
service-object tcp eq 8080
service-object tcp eq citrix-ica
service-object udp eq 1604
access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 a
ny host 172.17.253.6
access-list outside_access_in extended permit tcp any host 172.17.253.40 object-
group DM_INLINE_TCP_1
access-list outside_access_in extended permit tcp any host 172.17.253.38 eq ssh
access-list outside_access_in extended permit tcp any host 172.17.253.14 object-
group DM_INLINE_TCP_0
access-list outside_access_in extended permit tcp any host 172.17.253.11 eq http
s
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 Inside-VLAN1 255.255.255.0
nat (inside) 1 Inside-VLAN2 255.255.255.0
nat (inside) 1 Inside-VLAN3 255.255.255.0
static (inside,outside) tcp 172.17.253.38 ssh 172.17.1.7 ssh netmask 255.255.255
.255
static (inside,outside) 172.17.253.14 Lotus netmask 255.255.255.255
static (inside,outside) 172.17.253.6 172.17.1.6 netmask 255.255.255.255
static (inside,outside) 172.17.253.40 172.17.1.40 netmask 255.255.255.255
access-group outside_access_in in interface outside
!
router rip
passive-interface inside
!
route outside 0.0.0.0 0.0.0.0 172.17.253.26 1
route inside Inside-VLAN2 255.255.255.0 172.17.3.1 1
route inside Inside-VLAN3 255.255.255.0 172.17.3.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication enable console LOCAL
aaa authentication telnet console LOCAL
aaa authentication http console LOCAL
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
dhcpd auto_config outside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
!
!
prompt hostname context
: end
