Need Help Configuring Static NAT and Access List
Bookmark this page:
 Yahoo!
 Google
 Windows Live
 del.icio.us
 digg
 Netscape
|
|
|||||||||||||
|
Posted by tman on June 17, 2008, 9:24 pm
Please log in for more thread options access-list and one static NAT statement but I cannot get packets from outside to the host on the dmz. The ip address on the outside interface is 200.1.1.132. The ip address on the dmz interface is 192.168.20.1. To test I have one host, 200.1.1.131 connected to the outside interface and a second host, 192.168.20.134 connected to the dmz interface. I am running a utility called Attacker on the host in the dmz that is listening on port 110. To test I just telnet from the outside host to port 110 on the host in the dmz. So far I have been unsuccessful. Here are my access-list and its grouping to the outside interface and my static NAT statement Am I missing something? Do I have to add 200.1.1.134 to the outside interface as a virtual ip address like some firewalls or does the static nat accomplish this? access-list OutsideToDmz extended permit tcp any host 200.1.1.134 eq pop3 access-group OutsideToDmz in interface outside static (outside,dmz) 192.168.20.134 200.1.1.134 netmask 255.255.255.255 Any suggestions will be greatly appreciated. Thanks | |||||||||||||
|
Posted by jcle on June 17, 2008, 9:58 pm
Please log in for more thread options I think it is static(dmz,outside) 192.168,20.134 200.1.1.234 netmask 255.255.255.255 | |||||||||||||
|
Posted by mcaissie on June 18, 2008, 9:55 am
Please log in for more thread options
> I am trying to learn how to configure an ASA5505. I have written one
> access-list and one static NAT statement but I cannot get packets from > outside to the host on the dmz. > > The ip address on the outside interface is 200.1.1.132. The ip > address on the dmz interface is 192.168.20.1. > > To test I have one host, 200.1.1.131 connected to the outside > interface and a second host, 192.168.20.134 connected to the dmz > interface. I am running a utility called Attacker on the host in the > dmz that is listening on port 110. To test I just telnet from the > outside host to port 110 on the host in the dmz. So far I have been > unsuccessful. > > Here are my access-list and its grouping to the outside interface and > my static NAT statement Am I missing something? Do I have to add > 200.1.1.134 to the outside interface as a virtual ip address like some > firewalls or does the static nat accomplish this? > > access-list OutsideToDmz extended permit tcp any host 200.1.1.134 eq > pop3 > > access-group OutsideToDmz in interface outside > > static (outside,dmz) 192.168.20.134 200.1.1.134 netmask > 255.255.255.255 > > Any suggestions will be greatly appreciated. > > Thanks >>I think it is static(dmz,outside) 192.168,20.134 200.1.1.234 netmask
>>255.255.255.255 Actually it's static (dmz,outside) 200.1.1.234 192.168.20.134 netmask 255.255.255.255 static (real,fake) fake real netmask 255.255.255.255 | |||||||||||||
|
Posted by tman on June 18, 2008, 12:26 pm
Please log in for more thread options >
> > > > > > > I am trying to learn how to configure an ASA5505. I have written one
> > access-list and one static NAT statement but I cannot get packets from > > outside to the host on the dmz. >
> > The ip address on the outside interface is 200.1.1.132. The ip
> > address on the dmz interface is 192.168.20.1. >
> > To test I have one host, 200.1.1.131 connected to the outside
> > interface and a second host, 192.168.20.134 connected to the dmz > > interface. I am running a utility called Attacker on the host in the > > dmz that is listening on port 110. To test I just telnet from the > > outside host to port 110 on the host in the dmz. So far I have been > > unsuccessful. >
> > Here are my access-list and its grouping to the outside interface and
> > my static NAT statement Am I missing something? Do I have to add > > 200.1.1.134 to the outside interface as a virtual ip address like some > > firewalls or does the static nat accomplish this? >
> > access-list OutsideToDmz extended permit tcp any host 200.1.1.134 eq
> > pop3 >
> > access-group OutsideToDmz in interface outside
>
> > static (outside,dmz) 192.168.20.134 200.1.1.134 netmask
> > 255.255.255.255 >
> > Any suggestions will be greatly appreciated.
>
> > Thanks
> >>I think it is static(dmz,outside) 192.168,20.134 200.1.1.234 netmask
> >>255.255.255.255 >
> Actually it's > > static (dmz,outside) 200.1.1.234 192.168.20.134 netmask 255.255.255.255 > > static (real,fake) fake real netmask 255.255.255.255- Hide quoted text - > > - Show quoted text - Thanks. That finally worked. Jeeesh! These docs are difficult to interpret. They seem to always use weird examples rather than straight forward basic ones. | |||||||||||||
| Similar Threads | Posted |
| Need Help Configuring Static NAT and Access List | June 17, 2008, 9:24 pm |
| static nat and access-list | September 7, 2005, 5:31 am |
| Cisco Access Concentrator 3005 Access List | July 13, 2006, 3:27 pm |
| access-list addition blocking access to web server !?! | June 23, 2005, 10:49 pm |
| Pix Static Entry for Translation LIst | March 13, 2006, 12:31 pm |
| Have traffic access net from dmz with access-list applied | September 15, 2006, 4:26 pm |
| Configuring a 760 for internet access | February 10, 2006, 2:23 pm |
| Configuring Access for L2TP and PPTP Clients on PIX 506 E | February 2, 2006, 6:44 am |
| Problem Configuring Access Mode on an Interface on a Catalyst 3500XL | May 9, 2008, 2:35 pm |
| help on this access-list | September 25, 2005, 6:57 am |
| Access List Help | May 1, 2006, 10:02 am |
| access list | May 17, 2006, 9:39 am |
| PIX & access-list | June 1, 2006, 2:51 pm |
| Access List | November 30, 2006, 4:22 pm |
| PIX Access-List | December 4, 2006, 2:29 pm |
> access-list and one static NAT statement but I cannot get packets from
> outside to the host on the dmz.
>
> The ip address on the outside interface is 200.1.1.132. =A0The ip
> address on the dmz interface is 192.168.20.1.
>
> To test I have one host, 200.1.1.131 connected to the outside
> interface and a second host, 192.168.20.134 connected to the dmz
> interface. =A0I am running a utility called Attacker on the host in the
> dmz that is listening on port 110. =A0To test I just telnet from the
> outside host to port 110 on the host in the dmz. =A0So far I have been
> unsuccessful.
>
> Here are my access-list and its grouping to the outside interface and
> my static NAT statement =A0Am I missing something? =A0Do I have to add
> 200.1.1.134 to the outside interface as a virtual ip address like some
> firewalls or does the static nat accomplish this?
>
> access-list OutsideToDmz extended permit tcp any host 200.1.1.134 eq
> pop3
>
> access-group OutsideToDmz in interface outside
>
> static (outside,dmz) 192.168.20.134 200.1.1.134 netmask
> 255.255.255.255
>
> Any suggestions will be greatly appreciated.
>
> Thanks