Unable to display simple web page through nat. Yet other services work through nat

[necrify01]

Hi. this is doing my head in.

We use a asa 5510 with code 7.2. I'm trying to setup access to two simple webpages from the Internet. And they don't work. Traffic comes in on 212.217.2.44 and is natted across to 172.16.16.5. Similarly traffic comes in from 212.217.2.45 and is natted to 172.16.16.3. I can see the hit count increment on the external access rule increase. I see the corressponding NAT appear in the xlate table yet I get no webpage. If I plug a laptop into the 172.16.16.x subnet I can see the webpages. There are other NAT statements such as 212.217.2.42 is natted to 172.16.16.2 and this works. The only change I have made to this config is guest wifi. I used PAT. Any help would be appreciated.

Tony

[Pranay Prasoon]

Hi,

I did't get the description "If I plug a laptop into the 172.16.16.x subnet I can see the webpages"

Are you testing inbound or outbound traffic?

Two static statements are pointing the server in  DMZ1, also as you said that when you plug laptop it is working correctly. Where is the problem then?

thanks

[necrify01]

Hi thanks for your reply. I am testing for a request to come into the outside interface for a webpage which sits on dmz1. I don't get the webpage. If I plug a laptop into a switch which sits on dmz1 I can see the webpage so I know the web page works on the dmz1 subnet. However it doesn't work when trying to access it from the internet

[Pranay Prasoon · Accepted solution]

do you have default route on your severs.

Please take captures and see what is happening

access-list out permit ip any host 212.217.2.44

access-list out permit ip host 212.217.2.44 any

cap capo interface outside access-list out

access-list in permit ip any host 172.16.16.5

access-list in permit ip host 172.16.16.5 any

cap capi interface dmz1 access-list in

Try generating traffic and see the captures

show cap capi

show cap capo

[necrify01]

Thanks. From doing the capture we were able to work out what was happening. We saw the traffic coming into the outside interface but there was no traffic from dmz1. So we turned our attention to the switch and changed the vlan to an arbritary number and traffic started to flow. Why this worked I'm not sure.