We donot have  access to the Netscreen as it is managed by the vendor, so waiting for their response on routing.. But I do see very few hits probably coming from the tests done on the firewall itself.. I have asked the provider to check routing and i hope they will come back to us.. but Just to let you know the reason for asking regarding reverse NAt. We have another IP address that is NAtTEd for the provider to reach on port 25. The way it has been setup is one public IP for internet access, one for DMZ for provider access and there are two NAT rules  one on LAN itnerface out to Public IP and a reverse NAT on Public DMZ . I am not sure why that was required and I cannot remove it . And another question about packet capture, what would be the syntax if i were to monitor packets real time.. ... View more

You are right , PUBLIC - DMZ is the interface where the traffic hits the ASA. For the moment, I have only one NAT rule gvadc-fw/tgf# show nat LAN  1.1.1.1 255.255.255.255 match ip LAN host ActiveDirectory2 PUBLIC-DMZ any     static translation to ActiveDirectory_NAT     translate_hits = 0, untranslate_hits = 8 what else can I check? Does it require a reverse NAT? ... View more

gvadc-fw/tgf# packet-tracer input publIC-DMZ tcp "Source range from provider" 12345 10.10.10.10 Phase: 1 Type: FLOW-LOOKUP Subtype: Result: ALLOW Config: Additional Information: Found no matching flow, creating a new flow Phase: 2 Type: UN-NAT Subtype: static Result: ALLOW Config: static (LAN,PUBLIC-DMZ) ActiveDirectory_NAT ActiveDirectory2 netmask 255.255.255                                                                                                                                                             .255   match ip LAN host ActiveDirectory2 PUBLIC-DMZ any     static translation to ActiveDirectory_NAT     translate_hits = 0, untranslate_hits = 7 Additional Information: NAT divert to egress interface LAN Untranslate ActiveDirectory_NAT/0 to ActiveDirectory2/0 using netmask 255.255.25                                                                                                                                                             5.255 Phase: 3 Type: ACCESS-LIST Subtype: log Result: ALLOW Config: access-group ACL_PUBLIC-DMZ in interface PUBLIC-DMZ access-list ACL_PUBLIC-DMZ extended permit object-group DM_INLINE_SERVICE_9 obje                                                                                                                                                             ct-group DM_INLINE_NETWORK_73 host ActiveDirectory_NAT object-group service DM_INLINE_SERVICE_9 service-object icmp service-object tcp eq ldap object-group network DM_INLINE_NETWORK_73 network-object ORACLE_NEW_SUBNET1 255.255.252.0 network-object ORACLE_NEW_SUBNET3 255.255.252.0 network-object ORACLE_NEW_SUBNET2 255.255.248.0 Additional Information: Phase: 4 Type: IP-OPTIONS Subtype: Result: ALLOW Config: Additional Information: Phase: 5 Type: FOVER Subtype: standby-update Result: ALLOW Config: Additional Information: Phase: 6 Type: NAT Subtype: rpf-check Result: ALLOW Config: static (LAN,PUBLIC-DMZ) ActiveDirectory_NAT ActiveDirectory2 netmask 255.255.255                                                                                                                                                             .255   match ip LAN host ActiveDirectory2 PUBLIC-DMZ any     static translation to ActiveDirectory_NAT     translate_hits = 0, untranslate_hits = 7 Additional Information: Phase: 7 Type: NAT Subtype: host-limits Result: ALLOW Config: static (LAN,PUBLIC-DMZ) ActiveDirectory_NAT ActiveDirectory2 netmask 255.255.255                                                                                                                                                             .255   match ip LAN host ActiveDirectory2 PUBLIC-DMZ any     static translation to ActiveDirectory_NAT     translate_hits = 0, untranslate_hits = 7 Additional Information: Phase: 8 Type: IP-OPTIONS Subtype: Result: ALLOW Config: Additional Information: Phase: 9 Type: FLOW-CREATION Subtype: Result: ALLOW Config: Additional Information: New flow created with id 1612671295, packet dispatched to next module Phase: 10 Type: ROUTE-LOOKUP Subtype: output and adjacency Result: ALLOW Config: Additional Information: found next-hop 172.19.200.1 using egress ifc LAN adjacency Active next-hop mac address 0000.0c07.acc8 hits 23496521 Result: input-interface: PUBLIC-DMZ input-status: up input-line-status: up output-interface: LAN output-status: up output-line-status: up Action: allow gvadc-fw/tgf# ... View more

So the source IP belongs to the provider range and the destination is the NATted IP address on the DMZ ... View more

OK let me make it more clearer. Initially it was set to 10.1.1.1 and during the intervention we changed it to 172.19.44.23 by connecting to the managemnet port on our switch ... View more

show run int g3/0/10 Building configuration... Current configuration : 136 bytes ! interface GigabitEthernet3/0/10 switchport access vlan 44 switchport mode access end this is the configuration of the managemnt network interface . Initially the service port was set to 10.1.1.1 and was not routed anywhere. AP is on a different VLAN 172.19.6.x ... View more

Hi, We are in the process of upgrading our current wireless infrastructure. It includes 5500 controllers and 1142N antennas and WCS as a management solution. The biggest challenge now is to carry on an upgrade on our current infrastructure. Since 1142N are no longer sold officially in europe, we have to buy next generation antennas 1600 or 2600 . This forces us to invest in CPI hardware as a management solution. Is there not a phased approach that we can follow? Current controller version is 7.0.98... ... View more