ā12-14-2016 12:43 AM - edited ā02-21-2020 05:58 AM
Dear All,
I set some rule on ASA 5512 Ver9.5(2) by ASDM ver 7.5(2) and find some problem.
When I remove "access-list WAN1_to_inside extended permit ip any any", I can't connect ERPServer WHY ?
object network ERPServer
host 192.168.1.250
object network NETWORK_OBJ_192.168.1.0_24
subnet 192.168.1.0 255.255.255.0
object service 12322
service tcp source eq 12322
object network WAN1_Inside_Network
subnet 192.168.1.0 255.255.255.0
description for inside to outside use WTT
object service 12443
service tcp source eq 12443
object service 443
service tcp source eq https
access-list Local_Network standard permit 192.168.1.0 255.255.255.0
access-list WAN1_to_inside extended permit object 12322 any object ERPServer inactive
access-list WAN1_to_inside extended permit object 12443 any object ERPServer inactive
access-list WAN1_to_inside extended permit ip any any
access-list inside_to_outside extended permit ip any any
pager lines 24
logging enable
logging asdm informational
mtu WAN1 1500
mtu WAN2 1500
mtu inside 1500
mtu management 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-752.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (inside,WAN1) source static ERPServer interface service 22 12322 inactive
nat (inside,WAN1) source static ERPServer interface service 443 12443 inactive
ā12-14-2016 11:59 AM
Hi there, I have a couple of questions:
1. To what interfaces and what direction are the listed ACLs applied?
2. Have you tried using the packet-tracer feature to determine what is blocking the traffic?
https://supportforums.cisco.com/document/29601/troubleshooting-access-problems-using-packet-tracer
Thank you for rating helpful posts!
ā12-14-2016 05:49 PM
Dear Neno Spasov,
1) I want to external (WAN1) to internal (inside)
2) I tried packet-tracer, when remove "access-list WAN1_to_inside extended permit ip any any" no packet can access ERPServer.
ā12-15-2016 03:17 PM
Can you post the output from the packet-tracer result?
ā01-02-2017 07:27 AM
According to what is posted the access list has two inactive statements and one active statement (which is the permit any any). If you remove the permit any any then there is no statement permitting your traffic from outside to access the server.
access-list WAN1_to_inside extended permit object 12322 any object ERPServer inactive
access-list WAN1_to_inside extended permit object 12443 any object ERPServer inactive
access-list WAN1_to_inside extended permit ip any any
HTH
Rick
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide