We can trace from cli on asa5510 (8.0(3)) but can not from inside host. We have icmp and echo-reply on both interfaces. The logs show successful building/teardown of ICMP to/from the faddr and there are not any denies by acl's or errors. Any clues by you smart people? THANKS!!!!! C.T. ... View more

We are seeing rate limit drops on a new internet ethernet connection. I can't seem to find an explanation that does not have Qos in the reason for the rate limit drops. Here is what we see on a ASA 5520 running 6.4. Interface GigabitEthernet1/2 "outside", is up, line protocol is up   Hardware is VCS7380 rev01, BW 1000 Mbps, DLY 10 usec         Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)         Input flow control is unsupported, output flow control is unsupported         Media-type configured as RJ45 connector         Description: Outside connection to TWT port 0/1         MAC address c84c.xxxx.xxx, MTU 1500         IP address xxx.xxx.xxx.xxx, subnet mask 255.255.255.252         189630202 packets input, 151713633224 bytes, 0 no buffer         Received 201 broadcasts, 0 runts, 0 giants         0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort         0 L2 decode drops         168620541 packets output, 79755781476 bytes, 0 underruns         0 pause output, 0 resume output         0 output errors, 0 collisions, 0 interface resets         0 late collisions, 0 deferred         0 input reset drops, 0 output reset drops         406895 rate limit drops         input queue (blocks free curr/low): hardware (0/0)         output queue (blocks free curr/low): hardware (0/0)   Traffic Statistics for "outside":         189563376 packets input, 148146509320 bytes         169040114 packets output, 76924197238 bytes         2782075 packets dropped       1 minute input rate 1398 pkts/sec,  1258861 bytes/sec       1 minute output rate 1195 pkts/sec,  418651 bytes/sec       1 minute drop rate, 8 pkts/sec       5 minute input rate 2109 pkts/sec,  1888351 bytes/sec       5 minute output rate 1881 pkts/sec,  1019056 bytes/sec       5 minute drop rate, 11 pkts/sec When I do a 'sh run int g1/2' it shows nothing but the actual interface so I think that its not being dropped by us. The interface utilization is low so I dont think thats the issue. I am sure there is an easy explanation of why there are packets dropping, does anyone have it? THANKS!!!! ... View more

Problem: Outside access to Inside Citrix server. IP Info: ISP gave me x.x.x.16/30 so my IP address on e0/0 is x.x.x.18 ISP gave me x.x.x.24/29 as usable IP address's IP's I want to use: 192.168.76.12 = Citrix x.x.x.29 = NAT to Citrix On last site I had a /29 so my config was simple to NAT but here I 'thought' I could use sub interfaces but that is not working. Config: hostname Dasa names name 192.168.74.0 Vallywood description Valleywood D ! interface Ethernet0/0 speed 100 duplex full nameif OUTSIDE security-level 0 ip address x.x.x.18 255.255.255.252 ! interface Ethernet0/0.2 vlan 2 nameif Outside_IPs security-level 0 ip address x.x.x.25 255.255.255.248 ! interface Ethernet0/1 nameif INSIDE security-level 100 ip address 192.168.76.1 255.255.254.0 ! interface Ethernet0/2 shutdown no nameif no security-level no ip address ! interface Ethernet0/3 shutdown no nameif no security-level no ip address ! interface Management0/0 shutdown no nameif no security-level no ip address ! boot system disk0:/asa832-k8.bin ftp mode passive clock timezone CST -6 clock summer-time CDT recurring same-security-traffic permit intra-interface object network obj-192.168.76.0 subnet 192.168.76.0 255.255.254.0 object network Vallywood subnet 192.168.74.0 255.255.255.0 object network obj_any subnet 0.0.0.0 0.0.0.0 object network Citrix host 192.168.76.12 description Citrix Server Inside object network Citrix_Outside host x.x.x.29 description Citrix Server Outside object-group service DM_INLINE_SERVICE_1 service-object ip service-object icmp echo-reply object-group service DM_INLINE_SERVICE_2 service-object icmp echo service-object tcp-udp destination eq www service-object tcp destination eq 2598 access-list 101 extended permit icmp any any echo-reply inactive access-list 101 extended permit icmp any any source-quench inactive access-list 101 extended permit icmp any any unreachable inactive access-list 101 extended permit icmp any any time-exceeded inactive access-list INSIDE_access_in extended permit object-group DM_INLINE_SERVICE_1 any any access-list INSIDE_nat0_outbound extended permit ip 192.168.76.0 255.255.254.0 object Vallywood access-list OUTSIDE_1_cryptomap extended permit ip object obj-192.168.76.0 object Vallywood access-list Outside_access_in extended permit tcp any host 50.200.31.29 eq citrix-ica access-list Outside_access_in extended permit object-group DM_INLINE_SERVICE_2 any host x.x.x.29 pager lines 24 logging enable logging asdm informational mtu OUTSIDE 1500 mtu INSIDE 1500 mtu Outside_IPs 1500 failover timeout -1 icmp unreachable rate-limit 1 burst-size 1 asdm image disk0:/asdm-631.bin no asdm history enable arp timeout 14400 nat (INSIDE,any) source static obj-192.168.76.0 obj-192.168.76.0 destination static Vallywood Vallywood unidirectional nat (INSIDE,OUTSIDE) source static obj-192.168.76.0 obj-192.168.76.0 destination static Vallywood Vallywood nat (INSIDE,OUTSIDE) source static Citrix Citrix destination static Citrix_Outside Citrix_Outside description Citrix NAT ! object network obj_any nat (INSIDE,OUTSIDE) dynamic interface access-group Outside_access_in in interface OUTSIDE access-group INSIDE_access_in in interface INSIDE route OUTSIDE 0.0.0.0 0.0.0.0 x.x.x.17 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 dynamic-access-policy-reco rd DfltAccessPolicy http server enable http 0.0.0.0 0.0.0.0 INSIDE no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto ipsec security-association lifetime seconds 28800 crypto ipsec security-association lifetime kilobytes 4608000 crypto map OUTSIDE_map 1 match address OUTSIDE_1_cryptomap crypto map OUTSIDE_map 1 set pfs group1 crypto map OUTSIDE_map 1 set peer 2.2.2.2 crypto map OUTSIDE_map 1 set transform-set ESP-3DES-SHA crypto map OUTSIDE_map interface OUTSIDE crypto isakmp enable OUTSIDE crypto isakmp enable INSIDE crypto isakmp policy 120 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 crypto isakmp policy 65535 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 telnet 192.168.0.0 255.255.0.0 INSIDE telnet timeout 5 ssh timeout 5 console timeout 0 threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept webvpn group-policy GroupPolicy1 internal group-policy GroupPolicy1 attributes vpn-tunnel-protocol IPSec username root password IRP4f9U6/uZI6DzC encrypted tunnel-group 2.2.2.2 type ipsec-l2l tunnel-group 2.2.2.2 ipsec-attributes pre-shared-key ***** peer-id-validate nocheck ! ! prompt hostname context call-home profile CiscoTAC-1   no active   destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService   destination address email callhome@cisco.com   destination transport-method http   subscribe-to-alert-group diagnostic   subscribe-to-alert-group environment   subscribe-to-alert-group inventory periodic monthly   subscribe-to-alert-group configuration periodic monthly   subscribe-to-alert-group telemetry periodic daily Cryptochecksum:e818005e53e7571abb597401c371c510 : end [OK] Anyone have any tips to get this working? ... View more

I have two 5510's that I am trying to get a tunnel established. One has an exsistinig tunnel to a 5505 that works but I cant get the next one to get past the first phase. I have sanitized the attached configs, can anyone see something obvious? ... View more

We have a hub and spoke VPN setup and at one location used the DMZ port/vlan subnet to access the hub. We have since changed and want the DMZ to only access the outside interface (have base license that can only access one interface). We have taken out all the configs that allow access to inside/VPN but can not get the DMZ to access Outside/internet. I also do not see any debug info in the logs. We have read a ton but it seems that there are changes in 8.3 that are not documented well enough for us to get this going. Does anybody see what we are missing? Full Config: ASA Version 8.3(1) ! hostname Rye5505 domain-name thedavid enable password  encrypted passwd  encrypted names name 192.168.72.0 Sixpines description VPN ! interface Vlan1 nameif inside security-level 100 ip address 192.168.73.1 255.255.255.0 ! interface Vlan2 nameif outside security-level 0 ip address 69.15.200.138 255.255.255.252 ! interface Vlan5 no forward interface Vlan1 nameif dmz security-level 50 ip address 192.168.1.1 255.255.255.0 ! interface Ethernet0/0 switchport access vlan 2 ! interface Ethernet0/1 ! interface Ethernet0/2 ! interface Ethernet0/3 ! interface Ethernet0/4 ! interface Ethernet0/5 ! interface Ethernet0/6 ! interface Ethernet0/7 switchport access vlan 5 ! boot system disk0:/asa831-k8.bin ftp mode passive dns server-group DefaultDNS domain-name thedavid object network obj_any subnet 0.0.0.0 0.0.0.0 object network 192.168.72.0 subnet 192.168.72.0 255.255.255.0 description Sixpines   object network NETWORK_OBJ_192.168.73.0_24 subnet 192.168.73.0 255.255.255.0 object network obj-192.168.73.0 subnet 192.168.73.0 255.255.255.0 object network Sixpines subnet 192.168.72.0 255.255.255.0 object network DMZ subnet 192.168.1.0 255.255.255.0 object-group network SixpinesInternalNetwork network-object Sixpines 255.255.255.0 access-list DMZ_access_in extended permit ip any any inactive access-list DMZ_access_in extended permit ip object DMZ object obj_any inactive access-list outside_1_cryptomap extended permit ip object obj-192.168.73.0 object Sixpines access-list dmz extended permit ip object obj_any object DMZ pager lines 24 logging enable logging asdm informational mtu inside 1500 mtu outside 1500 mtu dmz 1500 icmp unreachable rate-limit 1 burst-size 1 icmp permit any inside icmp permit any outside icmp permit any dmz asdm image disk0:/asdm-631.bin no asdm history enable arp timeout 14400 nat (inside,any) source static obj-192.168.73.0 obj-192.168.73.0 destination static Sixpines Sixpines nat (inside,outside) source static obj-192.168.73.0 obj-192.168.73.0 destination static Sixpines Sixpines nat (dmz,outside) source static DMZ DMZ ! object network obj_any nat (inside,outside) dynamic interface access-group dmz in interface dmz route outside 0.0.0.0 0.0.0.0 69.15.200.137 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 dynamic-access-policy-record DfltAccessPolicy http server enable http 192.168.73.0 255.255.255.0 inside http 10.0.1.0 255.255.255.0 dmz http Sixpines 255.255.255.0 inside http 192.168.1.0 255.255.255.0 dmz no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto ipsec security-association lifetime seconds 28800 crypto ipsec security-association lifetime kilobytes 4608000 crypto map outside_map 1 match address outside_1_cryptomap crypto map outside_map 1 set pfs group1 crypto map outside_map 1 set peer 72.54.197.28 crypto map outside_map 1 set transform-set ESP-3DES-SHA crypto map outside_map 1 set reverse-route crypto map outside_map interface outside crypto isakmp enable inside crypto isakmp enable outside crypto isakmp policy 10 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 telnet timeout 5 ssh timeout 5 console timeout 0 management-access inside dhcpd auto_config outside ! dhcpd address 192.168.73.101-192.168.73.132 inside dhcpd dns 192.168.72.14 8.8.8.8 interface inside dhcpd domain thedavidlawfirm interface inside dhcpd enable inside ! threat-detection basic-threat threat-detection statistics port threat-detection statistics protocol threat-detection statistics access-list no threat-detection statistics tcp-intercept webvpn tunnel-group 72.54.197.28 type ipsec-l2l tunnel-group 72.54.197.28 ipsec-attributes pre-shared-key ! ! prompt hostname context call-home profile CiscoTAC-1   no active   destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService   destination address email callhome@cisco.com   destination transport-method http   subscribe-to-alert-group diagnostic   subscribe-to-alert-group environment   subscribe-to-alert-group inventory periodic monthly   subscribe-to-alert-group configuration periodic monthly   subscribe-to-alert-group telemetry periodic daily Cryptochecksum: : end asdm image disk0:/asdm-631.bin no asdm history enable OUTPUT of log..... 6      Sep 29 2008      19:31:32      302015      8.8.8.8      53      192.168.1.110      59468      Built outbound UDP connection 2298 for outside:8.8.8.8/53 (8.8.8.8/53) to dmz:192.168.1.110/59468 (192.168.1.110/59468) 6      Sep 29 2008      19:31:30      302016      8.8.8.8      53      192.168.1.110      62740      Teardown UDP connection 2234 for outside:8.8.8.8/53 to dmz:192.168.1.110/62740 duration 0:02:08 bytes 110 THANKS!!!! ... View more

Below is a on going chat i am having with a PIX expert... Can anyone see where the problem is when you read the message below??? Cisco ASA 5510 configuration for host inside private network Question: We have a Citrix host behind a new 5510 that needs to be accessed by the public. I have tried to follow the examples on cisco.com but still continue to get errors. I KNOW I am missing something simple. I have taken out all my 'tries' and have basic config below with errors. I am new to PIX/ASA and would live some suggestions on the proper Access Group and corresponding ACL to get the 192.168.71.100/72.54.197.26 Citrix server to accept ssl from outside. ASA Version 7.0(8) ! interface Ethernet0/0 description Outside interface to Cbeyond nameif OUTSIDE security-level 0 ip address 72.54.197.28 255.255.255.248 ! interface Ethernet0/1 description Inside interface to internal network nameif INSIDE security-level 100 ip address 192.168.72.2 255.255.255.0 ! interface Ethernet0/2 shutdown no nameif no security-level no ip address ! interface Management0/0 nameif management security-level 100 ip address 192.168.71.2 255.255.255.0 management-only ! object-group service Citrix1494 tcp port-object eq citrix-ica port-object eq www port-object eq https port-object range 445 447 nat-control global (OUTSIDE) 1 interface nat (INSIDE) 1 0.0.0.0 0.0.0.0 static (OUTSIDE,INSIDE) 192.168.72.100 72.54.197.26 netmask 255.255.255.255 static (INSIDE,OUTSIDE) 72.54.197.26 192.168.72.100 netmask 255.255.255.255 route OUTSIDE 0.0.0.0 0.0.0.0 72.54.197.25 100 http server enable http 192.168.71.0 255.255.255.0 management class-map inspection_default match default-inspection-traffic ! ! policy-map global_policy class inspection_default   inspect dns maximum-length 512   inspect ftp   inspect h323 h225   inspect h323 ras   inspect rsh   inspect rtsp   inspect esmtp   inspect sqlnet   inspect skinny   inspect sunrpc   inspect xdmcp   inspect sip   inspect netbios   inspect tftp ! Error Log: 3|Apr 15 2011 21:06:07|305005: No translation group found for tcp src INSIDE:192.168.72.75/57508 dst OUTSIDE:72.54.197.26/443 3|Apr 15 2011 21:06:01|305005: No translation group found for tcp src INSIDE:192.168.72.75/57508 dst OUTSIDE:72.54.197.26/443 3|Apr 15 2011 21:05:58|305005: No translation group found for tcp src INSIDE:192.168.72.75/57508 dst OUTSIDE:72.54.197.26/443 5|Apr 15 2011 21:05:42|111008: User 'root' executed the 'no access-list OUTSIDE_access_in extended permit tcp host 72.54.197.26 host 72.54.197.26' command. 4|Apr 15 2011 21:05:20|106023: Deny tcp src OUTSIDE:114.38.58.208/2817 dst INSIDE:72.54.197.26/445 by access-group "OUTSIDE_access_in" 4|Apr 15 2011 21:05:17|106023: Deny tcp src OUTSIDE:114.38.58.208/2817 dst INSIDE:72.54.197.26/445 by access-group "OUTSIDE_access_in" 4|Apr 15 2011 21:04:37|106023: Deny tcp src OUTSIDE:221.1.220.185/12200 dst INSIDE:72.54.197.26/1080 by access-group "OUTSIDE_access_in" 4|Apr 15 2011 21:03:50|106023: Deny tcp src OUTSIDE:32.141.52.12/1787 dst INSIDE:72.54.197.26/443 by access-group "OUTSIDE_access_in" 4|Apr 15 2011 21:03:44|106023: Deny tcp src OUTSIDE:32.141.52.12/1787 dst INSIDE:72.54.197.26/443 by access-group "OUTSIDE_access_in" 4|Apr 15 2011 21:03:41|106023: Deny tcp src OUTSIDE:32.141.52.12/1787 dst INSIDE:72.54.197.26/443 by access-group "OUTSIDE_access_in" 4|Apr 15 2011 21:02:23|106023: Deny tcp src OUTSIDE:32.141.52.12/1785 dst INSIDE:72.54.197.26/443 by access-group "OUTSIDE_access_in" 4|Apr 15 2011 21:02:17|106023: Deny tcp src OUTSIDE:32.141.52.12/1785 dst INSIDE:72.54.197.26/443 by access-group "OUTSIDE_access_in" 4|Apr 15 2011 21:02:14|106023: Deny tcp src OUTSIDE:32.141.52.12/1785 dst INSIDE:72.54.197.26/443 by access-group "OUTSIDE_access_in" 5|Apr 15 2011 21:01:56|111008: User 'root' executed the 'access-list OUTSIDE_access_in line 1 extended permit tcp host 72.54.197.26 host 72.54.197.26' command. 6|Apr 15 2011 21:00:13|302013: Built outbound TCP connection 7173 for OUTSIDE:150.70.85.65/443 (150.70.85.65/443) to INSIDE:192.168.72.100/2959 (72.54.197.26/2959) 6|Apr 15 2011 20:56:57|302016: Teardown UDP connection 7082 for OUTSIDE:72.54.197.26/137 to INSIDE:192.168.72.17/137 duration 0:02:01 bytes 62 6|Apr 15 2011 20:55:19|302013: Built outbound TCP connection 7088 for OUTSIDE:184.85.253.178/80 (184.85.253.178/80) to INSIDE:192.168.72.100/2879 (72.54.197.26/2879) 6|Apr 15 2011 20:55:19|302013: Built outbound TCP connection 7086 for OUTSIDE:74.125.159.147/80 (74.125.159.147/80) to INSIDE:192.168.72.100/2878 (72.54.197.26/2878) 6|Apr 15 2011 20:54:55|302015: Built outbound UDP connection 7082 for OUTSIDE:72.54.197.26/137 (192.168.72.100/137) to INSIDE:192.168.72.17/137 (72.54.197.28/24) 6|Apr 15 2011 20:54:17|302021: Teardown ICMP connection for faddr 10.160.68.225/0 gaddr 72.54.197.26/1 laddr 192.168.72.100/1 6|Apr 15 2011 20:54:15|302020: Built outbound ICMP connection for faddr 10.160.68.225/0 gaddr 72.54.197.26/1 laddr 192.168.72.100/1 6|Apr 15 2011 20:54:13|302021: Teardown ICMP connection for faddr 172.28.16.2/0 gaddr 72.54.197.26/1 laddr 192.168.72.100/1 6|Apr 15 2011 20:54:12|302013: Built outbound TCP connection 7074 for OUTSIDE:199.7.52.190/80 (199.7.52.190/80) to INSIDE:192.168.72.100/2815 (72.54.197.26/2815) 6|Apr 15 2011 20:54:12|302013: Built outbound TCP connection 7073 for OUTSIDE:199.7.55.72/80 (199.7.55.72/80) to INSIDE:192.168.72.100/2813 (72.54.197.26/2813) 6|Apr 15 2011 20:54:12|302013: Built outbound TCP connection 7072 for OUTSIDE:199.7.55.72/80 (199.7.55.72/80) to INSIDE:192.168.72.100/2812 (72.54.197.26/2812) 6|Apr 15 2011 20:54:12|302013: Built outbound TCP connection 7071 for OUTSIDE:199.7.52.190/80 (199.7.52.190/80) to INSIDE:192.168.72.100/2811 (72.54.197.26/2811) 6|Apr 15 2011 20:54:12|302013: Built outbound TCP connection 7070 for OUTSIDE:184.85.253.19/80 (184.85.253.19/80) to INSIDE:192.168.72.100/2810 (72.54.197.26/2810) 3|Apr 15 2011 20:54:12|106014: Deny inbound icmp src OUTSIDE:172.28.16.2 dst INSIDE:72.54.197.26 (type 0, code 0) 6|Apr 15 2011 20:54:11|302020: Built outbound ICMP connection for faddr 172.28.16.2/0 gaddr 72.54.197.26/1 laddr 192.168.72.100/1 6|Apr 15 2011 20:54:10|302013: Built outbound TCP connection 7063 for OUTSIDE:64.4.18.90/80 (64.4.18.90/80) to INSIDE:192.168.72.100/2809 (72.54.197.26/2809) 3|Apr 15 2011 20:52:17|305005: No translation group found for tcp src INSIDE:192.168.72.75/56624 dst OUTSIDE:72.54.197.26/443 3|Apr 15 2011 20:52:11|305005: No translation group found for tcp src INSIDE:192.168.72.75/56624 dst OUTSIDE:72.54.197.26/443 3|Apr 15 2011 20:52:08|305005: No translation group found for tcp src INSIDE:192.168.72.75/56624 dst OUTSIDE:72.54.197.26/443 2|Apr 15 2011 20:50:02|106001: Inbound TCP connection denied from 187.28.118.35/1973 to 72.54.197.26/445 flags SYN  on interface OUTSIDE 2|Apr 15 2011 20:49:59|106001: Inbound TCP connection denied from 187.28.118.35/1973 to 72.54.197.26/445 flags SYN  on interface OUTSIDE 2|Apr 15 2011 20:49:58|106001: Inbound TCP connection denied from 184.27.73.83/443 to 72.54.197.26/60784 flags RST  on interface OUTSIDE 2|Apr 15 2011 20:49:58|106001: Inbound TCP connection denied from 184.27.73.83/443 to 72.54.197.26/60783 flags RST  on interface OUTSIDE 2|Apr 15 2011 20:49:58|106001: Inbound TCP connection denied from 184.27.73.83/443 to 72.54.197.26/60781 flags RST  on interface OUTSIDE 2|Apr 15 2011 20:49:58|106001: Inbound TCP connection denied from 184.27.73.83/443 to 72.54.197.26/60782 flags RST  on interface OUTSIDE 2|Apr 15 2011 20:49:58|106001: Inbound TCP connection denied from 184.27.73.83/443 to 72.54.197.26/60779 flags RST  on interface OUTSIDE 2|Apr 15 2011 20:49:58|106001: Inbound TCP connection denied from 184.27.73.83/443 to 72.54.197.26/60785 flags RST  on interface OUTSIDE 2|Apr 15 2011 20:49:35|106001: Inbound TCP connection denied from 217.10.43.52/1486 to 72.54.197.26/445 flags SYN  on interface OUTSIDE 2|Apr 15 2011 20:49:32|106001: Inbound TCP connection denied from 217.10.43.52/1486 to 72.54.197.26/445 flags SYN  on interface OUTSIDE 3|Apr 15 2011 20:48:17|305005: No translation group found for tcp src INSIDE:192.168.72.97/55593 dst OUTSIDE:72.54.197.26/443 3|Apr 15 2011 20:48:11|305005: No translation group found for tcp src INSIDE:192.168.72.97/55593 dst OUTSIDE:72.54.197.26/443 3|Apr 15 2011 20:48:08|305005: No translation group found for tcp src INSIDE:192.168.72.97/55593 dst OUTSIDE:72.54.197.26/443 THANKS!! Reply................................. ok do this: no static (OUTSIDE,INSIDE) 192.168.72.100 72.54.197.26 netmask 255.255.255.255 clear xlate access-list Outside-ACL extended permit tcp any host 72.54.197.26 object-group Citrix1494 access-group Outside-ACL in interface OUTSIDE That should do it for you.. /M_4911140.html Reply........................ kenboonejr: Your reverse static needs to be taken out. then you need to do a "clear xlate" command.  do that and post your config again and let me see it.  I'll be standing by. /M_6253131.html Was this comment helpful? Yes No charlietaylor: ASA Version 7.0(8) ! hostname 5510 domain-name xxxxx enable password xxxxx encrypted passwd xxxxx encrypted names dns-guard ! interface Ethernet0/0 description Outside interface to Cbeyond nameif OUTSIDE security-level 0 ip address 72.54.197.28 255.255.255.248 ! interface Ethernet0/1 description Inside interface to internal network nameif INSIDE security-level 100 ip address 192.168.72.2 255.255.255.0 ! interface Ethernet0/2 shutdown no nameif no security-level no ip address ! interface Management0/0 nameif management security-level 100 ip address 192.168.71.2 255.255.255.0 management-only ! banner exec xxxxx banner login VPN firewall/router ftp mode passive clock timezone CST -6 clock summer-time CDT recurring 1 Sun Apr 2:00 last Sun Oct 2:00 dns domain-lookup INSIDE dns name-server 66.180.96.12 dns name-server 64.180.96.12 object-group service Citrix1494 tcp port-object eq citrix-ica port-object eq www port-object eq https port-object range 445 447 access-list Outside-ACL extended permit tcp any host 72.54.197.26 object-group C itrix1494 pager lines 24 logging enable logging asdm informational logging mail critical logging from-address xxxxx mtu OUTSIDE 1500 mtu INSIDE 1500 mtu management 1500 asdm image disk0:/asdm-508.bin no asdm history enable arp timeout 14400 nat-control global (OUTSIDE) 1 interface nat (INSIDE) 1 0.0.0.0 0.0.0.0 static (INSIDE,OUTSIDE) 72.54.197.26 192.168.72.100 netmask 255.255.255.255 access-group Outside-ACL in interface OUTSIDE route OUTSIDE 0.0.0.0 0.0.0.0 72.54.197.25 100 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout uauth 0:05:00 absolute username root password xxxxxx encrypted privilege 15 http server enable http 192.168.71.0 255.255.255.0 management no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart crypto ipsec security-association lifetime seconds 28800 crypto ipsec security-association lifetime kilobytes 4608000 telnet 192.168.72.0 255.255.255.0 management telnet 192.168.73.0 255.255.255.0 management telnet 192.168.71.0 255.255.255.0 management telnet timeout 5 ssh timeout 5 console timeout 0 dhcpd address 192.168.71.3-192.168.71.254 management dhcpd dns 66.180.96.12 64.180.96.12 dhcpd lease 3600 dhcpd ping_timeout 50 ! class-map inspection_default match default-inspection-traffic ! ! policy-map global_policy class inspection_default   inspect dns maximum-length 512   inspect ftp   inspect h323 h225   inspect h323 ras   inspect rsh   inspect rtsp   inspect esmtp   inspect sqlnet   inspect skinny   inspect sunrpc   inspect xdmcp   inspect sip   inspect netbios   inspect tftp ! service-policy global_policy global smtp-server 66.180.96.57 Cryptochecksum:472013675a200d36e6155c03238fa05c : end [OK] 5510# Was this comment helpful? Yes No kenboonejr: Ok so at this point if you issues a clear xlate command that would have flushed the translation table and citrix should be able to get out with the current configuration.  If it can't post the logs for it..  This is the right config for what you want to do. Was this comment helpful? Yes No charlietaylor: Did that, no connections. Here is what the log says with the config above right after I cle xlate and try to connect from outside..... 6|Apr 21 2011 12:40:44|302014: Teardown TCP connection 8954 for OUTSIDE:74.125.159.105/80 to INSIDE:192.168.72.100/57140 duration 0:00:30 bytes 0 SYN Timeout 6|Apr 21 2011 12:40:43|302013: Built outbound TCP connection 9079 for OUTSIDE:74.125.159.105/80 (74.125.159.105/80) to INSIDE:192.168.72.100/57142 (72.54.197.26/57142) 6|Apr 21 2011 12:40:14|302013: Built outbound TCP connection 8954 for OUTSIDE:74.125.159.105/80 (74.125.159.105/80) to INSIDE:192.168.72.100/57140 (72.54.197.26/57140) 6|Apr 21 2011 12:40:13|302014: Teardown TCP connection 8618 for OUTSIDE:74.125.159.105/80 to INSIDE:192.168.72.100/57134 duration 0:00:30 bytes 0 SYN Timeout 6|Apr 21 2011 12:39:43|302013: Built outbound TCP connection 8618 for OUTSIDE:74.125.159.105/80 (74.125.159.105/80) to INSIDE:192.168.72.100/57134 (72.54.197.26/57134) 6|Apr 21 2011 12:39:35|302014: Teardown TCP connection 8369 for OUTSIDE:74.125.159.105/80 to INSIDE:192.168.72.100/57129 duration 0:00:30 bytes 0 SYN Timeout AND.... Citrix server can not even get out to internet, here is the logs say when you try to open a browser..... 6|Apr 21 2011 12:39:05|302013: Built outbound TCP connection 8369 for OUTSIDE:74.125.159.105/80 (74.125.159.105/80) to INSIDE:192.168.72.100/57129 (72.54.197.26/57129) 6|Apr 21 2011 12:38:55|302014: Teardown TCP connection 8227 for OUTSIDE:74.125.159.99/80 to INSIDE:192.168.72.100/57121 duration 0:00:30 bytes 0 SYN Timeout 6|Apr 21 2011 12:38:25|302013: Built outbound TCP connection 8227 for OUTSIDE:74.125.159.99/80 (74.125.159.99/80) to INSIDE:192.168.72.100/57121 (72.54.197.26/57121) 6|Apr 21 2011 12:37:36|302014: Teardown TCP connection 7667 for OUTSIDE:216.52.233.134/443 to INSIDE:192.168.72.100/57108 duration 0:00:30 bytes 0 SYN Timeout 6|Apr 21 2011 12:37:32|302014: Teardown TCP connection 7568 for OUTSIDE:74.125.159.99/80 to INSIDE:192.168.72.100/57107 duration 0:00:30 bytes 0 SYN Timeout Was this comment helpful? Yes No kenboonejr: ok so firewall is showing the rules for the inbound stuff working, but the citrix server is not responding that is why you are getting a SYN timeout. Does your citrix box have multiple IP addresses or multiple NICs? What is the default gateway on the citrix box. I can guarantee you that the config is good. The logs show sessions getting created - not blocked so its not the firewall causing the problem.  Something else is not quite right. Rank: Sage Was this comment helpful? Yes No kenboonejr: From the ASA can you ping the real ip address of the citix server? /M_6253131.html Was this comment helpful? Yes No charlietaylor: This network is in production. CurrentIy have a cheesy Lynksys router (the only thing it does is NAT for Citrix) and a "Transistion" throwdown firewall with two simple rules that allow all and allow outside to Citrix. The Citrix has one nic with default gatewway same as all other devices on network (72.2) and goes out just fine until I cut over to 5510. Then is can not get out. (and yes, all other equipment is turned off and the switches are power cycled afer I power up 5510 to make sure I am not having switch arp issues) The Citrix is in use 24/7 by remote users so I can't switch back and forth. (especialy during day when everybody goes out to Inet via this unit or the cheesy gear I am replacing) I see the connections too but it connects for half a second and sends 0 bytes..... hmmmm /M_4911140.html Rank: Sage Was this comment helpful? Yes No kenboonejr: you are having arp issues with the citrix box i would think. so once you cutover to the ASA .. can you ping the citrix box from the ASA? The citrix arp table still shows the mac address of the linksys 72.2 interface is my guess and you would need to flush the arp table on the citrix server. Also, how does the internet connect.  Is it straight to the linksys router?  Is this cable, DSL or T1 to a provider router or what.  There is a router on the outside of the ASA of some sort.  It could be that that devices still has the mac address of public side MAC address of the citrix box in its ARP table.  Most likely that needs a reboot as well to flush its ARP table.  I would bet on it. I have been working on Cisco firewall since before Cisco bought the PIX.  I can assure the config is good without that reverse static. /M_6253131.html Was this comment helpful? Yes No charlietaylor: OK... but if it is an ARP issue would the 5510 still get the info that it is in the logs? I mean, if packets were headed to another port why am I seeing SCR/DES info in the logs? /M_6253131.html Was this comment helpful? Yes No charlietaylor: AND... I REALLY apperciate all your help! /M_4911140.html Rank: Sage Was this comment helpful? Yes No kenboonejr: you got a point there.  Here is what I know.  When you try to access it from the outside... the citrix doesn't respond.  So could it be at that point the citrix box has the old arp entry for the linksys? so the packets aren't getting back. So if you cut over. start everything fresh.  turn off linksys.  reboot ISP router/device.  flush arp table on citrix.  Then ping the citrix box from the ASA.  If that works then try the connection from the outside.  How are you connecting to the outside?  Are you at a different location or are you on a mobile broadband card or what? Was this comment helpful? Yes No charlietaylor: I am physically sitting on the network. I am trying access from outside on my broadband card that is known to connect. Their office is closed tomorrow and I am getting access to come in and powercycle every single device. I will then first try to ping Citrix from ASA and move downstream like you suggest. Thanks again, I really do hope it is a ARP issue in a device I did not reload. (the ACTELIS ISP box and actual Citrix server) I will let you know. Was this comment helpful? Yes No charlietaylor: reboot of every device in the network did not change anything /M_6253131.html Was this comment helpful? Yes No charlietaylor: the ASA can ping the citrix server /M_777876.html Was this comment helpful? Yes No slamjam2000: From your config, I don't see a route to the inside...  The only route on the ASA is to the outside: route OUTSIDE 0.0.0.0 0.0.0.0 72.54.197.25 100 Was this comment helpful? Yes No charlietaylor: so what are you suggesting? ... View more