Hi All, Have a simple setup as below, am able to see the ip nat translation happening however the router does not forward the packet to fw client -- router 1941 (10.70.117.249) ---- (10.70.117.250)FW -- F5 (10.70.117.110) client try to establish connection to 42.xx.xx.xx which gets nat to 10.70.117.110   can anyone please help me what am missing in the configuration   Thank you   interface Embedded-Service-Engine0/0  no ip address  shutdown ! interface GigabitEthernet0/0  ip address 124.xx.xx.xx 255.255.255.252  ip access-group WAN in  no ip redirects  no ip unreachables  no ip proxy-arp  ip nat outside  ip virtual-reassembly in  duplex full  speed 100  no cdp enable ! interface GigabitEthernet0/1  description to sdcfwwR3 port 0 LAN  ip address 10.70.117.249 255.255.255.240  no ip redirects  no ip unreachables  no ip proxy-arp  ip nat inside  ip virtual-reassembly in  duplex full  speed 100  no cdp enable ! ip forward-protocol nd ! no ip http server no ip http secure-server ! ip nat inside source static 10.70.117.10 42.xx.xx.xx ip route 0.0.0.0 0.0.0.0 124.xx.xx.xx ip route 10.70.117.110 255.255.255.255 10.70.117.250 ip route 10.70.118.0 255.255.255.128 10.70.117.250 ! ip access-list extended WAN  deny   ip 127.0.0.0 0.255.255.255 any  deny   ip 192.0.20.0 0.0.0.255 any  deny   ip 224.0.0.0 31.255.255.255 any  deny   ip host 255.255.255.255 any  deny   ip 10.0.0.0 0.255.255.255 any  deny   ip 172.16.0.0 0.15.255.255 any  deny   ip 192.168.0.0 0.0.255.255 any  deny   ip 169.254.0.0 0.0.255.255 any  permit tcp any host 42.xx.xx.xx eq 443  permit udp any host 42.xx.xx.xx eq 4433  deny   ip any any ! ! ! ! control-plane ! ! ! line con 0  login local line aux 0 line 2  no activation-character  no exec  transport preferred none  transport output pad telnet rlogin lapb-ta mop udptn v120 ssh  stopbits 1 line vty 0 4  login local  transport input none line vty 5 15  exec-timeout 5 0  privilege level 15  login local  transport input ssh ! scheduler allocate 20000 1000 ! end         ... View more

Hi All, We have a ASA5505 which does not allow ping to connected vlans PCA -- CRSW -- ASA5510  -----------VPN----------- ASA5505  -- SW -- Users (PCX) ASA5505 Data Vlan - 10.9.2.253 XX Vlan - 10.9.3.253 SW -- 10.9.2.1 PCX - 10.9.2.10 PCA can ping 10.9.2.253, but can not ping 10.9.2.1 and 10.9.2.10, below is the packet tracer which says host-limit block can i get any suggestions please, many thanks for the support cheers.. BJ-FW01# packet-tracer input daTA-VLAN icmp 10.9.2.1 8 0 10.3.1.5 detailed Phase: 1 Type: ACCESS-LIST Subtype: Result: ALLOW Config: Implicit Rule Additional Information: Forward Flow based lookup yields rule: in  id=0xca126b60, priority=1, domain=permit, deny=false         hits=425, user_data=0x0, cs_id=0x0, l3_type=0x8         src mac=0000.0000.0000, mask=0000.0000.0000         dst mac=0000.0000.0000, mask=0100.0000.0000         input_ifc=DATA-VLAN, output_ifc=any Phase: 2 Type: ROUTE-LOOKUP Subtype: input Result: ALLOW Config: Additional Information: in   0.0.0.0         0.0.0.0         OUTSIDE Phase: 3 Type: ACCESS-LIST Subtype: log Result: ALLOW Config: access-group ACL_DATA-VLAN in interface DATA-VLAN access-list ACL_DATA-VLAN extended permit icmp any any echo Additional Information: Forward Flow based lookup yields rule: in  id=0xca16fa70, priority=13, domain=permit, deny=false         hits=35, user_data=0xc82824b0, cs_id=0x0, use_real_addr, flags=0x0, protocol=1         src ip/id=0.0.0.0, mask=0.0.0.0, icmp-type=8         dst ip/id=0.0.0.0, mask=0.0.0.0, icmp-code=0, dscp=0x0         input_ifc=DATA-VLAN, output_ifc=any Phase: 4 Type: IP-OPTIONS Subtype: Result: ALLOW Config: Additional Information: Forward Flow based lookup yields rule: in  id=0xca12a9c8, priority=0, domain=inspect-ip-options, deny=true         hits=235, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0         src ip/id=0.0.0.0, mask=0.0.0.0, port=0         dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0         input_ifc=DATA-VLAN, output_ifc=any Phase: 5 Type: INSPECT Subtype: np-inspect Result: ALLOW Config: Additional Information: Forward Flow based lookup yields rule: in  id=0xca12a5b0, priority=66, domain=inspect-icmp-error, deny=false         hits=40, user_data=0xca129bc8, cs_id=0x0, use_real_addr, flags=0x0, protocol=1         src ip/id=0.0.0.0, mask=0.0.0.0, icmp-type=0         dst ip/id=0.0.0.0, mask=0.0.0.0, icmp-code=0, dscp=0x0         input_ifc=DATA-VLAN, output_ifc=any Phase: 6 Type: HOST-LIMIT Subtype: Result: DROP Config: Additional Information: Forward Flow based lookup yields rule: in  id=0xc72790a0, priority=0, domain=host-limit, deny=false         hits=221, user_data=0x0, cs_id=0x0, flags=0x0, protocol=0         src ip/id=0.0.0.0, mask=0.0.0.0, port=0         dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0         input_ifc=DATA-VLAN, output_ifc=any Result: input-interface: DATA-VLAN input-status: up input-line-status: up output-interface: OUTSIDE output-status: up output-line-status: up Action: drop Drop-reason: (acl-drop) Flow is denied by configured rule ... View more

Hi All, I need to allow one of the vendor to park their server in our network and plan to place it in DMZ zone, but the server need secure access back to their DC and we need to publish and pull data to/from the server Am wondering is it a good idea to allow the vendor to establish a ipsec vpn to my asa and then allow the server to go out and also need to allow my users to get and put data to the server am not a security guy, can someone please give me some hints to get this done many thanks cheers.. ... View more