Heads Up :
The post you are writing will appear in a public forum. Please ensure all content is appropriate for public consumption. Review the employee guidelines for the community here.
We have two datacenters, with an ASA 5510 pair in one (datacenter A) and an ASA 5520pair in the other (datacenter B). The 5510 presents multiple web-based services to the Internet via static NAT. We also have a site-to-site VPN connecting the two d...
After recently moving all our server infrastructure offsite, our firewall needs in our corporate office have been simplified: establish VPN tunnels to our datacenters, block all public incoming traffic, selectively block outgoing public traffic. Sin...
We have a pair of ASA 5510s in an active/passive HA configuration. Remote users connect via AnyConnect and access resources in our corporate site. We also have three IPSec site-to-site VPNs to link our datacenter sites with the corporate site.We no...
Our remote users already use AnyConnect to access our corporate network when offsite. We're in the process of implementing split tunneling through group policy, where more trusted users can have non-work traffic go directly to the internet, but less...
It wasn't a NAT issue. I went back through my saved configurations and I saw that I'd added the NAT exception for VPN to DC-A when I first added VPN to the configuration profile. The "no translation group" errors are actually from my client trying ...
arrgh...some days I have extended stupid.I went back to a config I saved this morning, and the "1" ACE was already there, so I imagine that's not a mistake or a security risk.There was also this:access-list external_nat0_outbound extended permit ip 1...
So I did this:access-list external_nat0_outbound_1 extended permit ip 192.168.4.0 255.255.255.0 192.168.20.0 255.255.255.0I got three new ACEs: external_nat0_outbound_1, external_nat0_outbound, and "1", with the last allowing TCP from any to any. I ...
Well, that's something.I get "%ASA-3-305005: No translation group found for udp src external:192.168.4.10/137 dst external:192.168.4.255/137" when I try to ping a host in DC A.
The DC A Firewall (provided to us by the co-location center, and based on open source) has a static route to VPN/24 which specifies the inside address on the ASA (192.168.10.252) as the gateway.Now that I type that I'm seriously wondering if that's c...