Dear ALL,
I have an ASA 5510 sw release 8.0(2) and you can find configuration at the end of this document.
I have connected a LAN (PCs and Servers) of a customer to the INSIDE , and everything is working properly.
But I have to connect another customer which computers are behind an ISA Server, and troubles get started.
(ISA Sever has been conencted to DMZ , and INSIDE too for test purpose, but the same troubles occour)
Some time it doesn't run, or when it start running properly it stops run after a period of time (diffferent periods time after time)
Please, anyone of you could give any suggest about it?
Regards
Alberto Brivio
C O N F I G U R A T I O N (proxyarp is enabled on all interface)
names
!
interface Ethernet0/0
description Interfaccia verso ITGATE
nameif outside
security-level 0
ip address A.B.C.98 255.255.255.224
!
interface Ethernet0/1
nameif inside
security-level 100
ip address 192.168.6.1 255.255.255.0
!
interface Ethernet0/2
description Interfaccia LAN interna ARTHA
nameif dmz1
security-level 50
ip address 192.168.7.1 255.255.255.0
!
interface Ethernet0/3
shutdown
nameif unused
security-level 0
no ip address
!
interface Management0/0
nameif management
security-level 100
ip address 192.168.10.1 255.255.255.0
management-only
!
boot system disk0:/asa802-k8.bin
ftp mode passive
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
dns server-group DefaultDNS
same-security-traffic permit inter-interface
access-list acl-outbound extended permit icmp any any
access-list acl-outbound extended permit ip any any
access-list acl-outbound extended permit gre any any
access-list acl-outbound extended permit esp any any
access-list acl-inbound extended permit icmp any any
access-list acl-inbound extended permit gre any any
access-list acl-inbound extended permit tcp any any eq pptp
access-list acl-inbound extended permit tcp any host A.B.C.126 eq www
access-list acl-inbound extended permit tcp any host A.B.C.126 eq ftp-data
access-list acl-inbound extended permit tcp any host A.B.C.126 eq ftp
access-list acl-inbound extended permit tcp any host A.B.C.126 eq https
access-list acl-inbound extended permit tcp any host A.B.C.126 eq pptp
access-list acl-inbound extended permit gre any host A.B.C.126
access-list acl-inbound extended permit tcp any host A.B.C.99 eq www
access-list acl-inbound extended deny ip any any
access-list acl-dmz1 extended permit icmp any any
access-list acl-dmz1 extended permit ip any any
pager lines 24
logging enable
logging timestamp
logging trap debugging
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu dmz1 1500
mtu unused 1500
mtu management 1500
ip verify reverse-path interface outside
icmp unreachable rate-limit 1 burst-size 1
icmp permit any outside
icmp permit any inside
icmp permit any dmz1
asdm image disk0:/asdm-602.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 192.168.6.0 255.255.255.0
static (inside,outside) A.B.C.99 192.168.6.28 netmask 255.255.255.255
static (dmz1,outside) A.B.C.126 192.168.7.7 netmask 255.255.255.255
static (dmz1,outside) A.B.C.103 192.168.7.100 netmask 255.255.255.255
access-group acl-inbound in interface outside
access-group acl-outbound in interface inside
access-group acl-dmz1 in interface dmz1
route outside 0.0.0.0 0.0.0.0 A.B.C.97 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
http server enable
no snmp-server location
no snmp-server contact
snmp-server community xyz
snmp-server enable traps snmp authentication linkup linkdown coldstart
snmp-server enable traps syslog
snmp-server enable traps ipsec start stop
snmp-server enable traps entity config-change fru-insert fru-remove
snmp-server enable traps remote-access session-threshold-exceeded
crypto isakmp policy 10
authentication pre-share
encryption aes-256
hash sha
group 5
lifetime 86400
crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
no crypto isakmp nat-traversal
no vpn-addr-assign dhcp
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 inside
ssh 0.0.0.0 0.0.0.0 management
ssh timeout 30
console timeout 0
dhcpd address 192.168.10.2-192.168.10.254 management
!
threat-detection basic-threat
threat-detection statistics access-list
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns migrated_dns_map_1
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns migrated_dns_map_1
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
prompt hostname context
