2

I have a Cisco ASA 5510 on 8.2(5). NATing works fine but where my issues is that it seems the only way to get traffic through from outside-->inside is through a "any any ip" rule which I don't want. I have the other respective rules setup for smtp to exchange server etc but the only rule that will allow traffic is the any any rule. I am not sure what I am missing here.

Any help will be greatly appreciated!

Improve this question
2
  • 3
    If you could, posting a sanitized version of the configuration would greatly help us answer your question.
    – Brett Lykins
    Apr 9, 2014 at 19:33
  • Also use packet tracer to see if the flow is created or if it fails at some step. I assume that your outside has a security level of 0 and inside has a security level of 100? You can also capture traffic to see if it is coming in. Do you have an ACL for traffic coming from the inside and going out? Remember, traffic is bidirectional.
    – Daniel Dib
    Apr 10, 2014 at 5:18

1 Answer 1

Reset to default
2

ACLs, NAT and routing are pretty much the only thing that will stop this traffic from getting through.

Because you said if you put a permit ip any any on your outside ACL then I believe NAT and routing are working fine.

Place an ACL to permit from anywhere to your MAPPED or NAT'd IP. This is probably the public IP and not the private IP of your exchange server. In ASA 8.2(5) and below the ACLs use the NAT'd IP. In ASA 8.3 and above the ACLs use the real IP. Make sure that ACL is above any other denies.

Turn logging on and make sure your denies are getting logged. Watch the logs to find out what rule you're getting denied by.

As another person said, try using the packet tracer command/wizard to simulate the packet coming in through the outside interface and take note of where it gets stopped.

Improve this answer
1
  • Wow, thanks for the great info. I thought this site was going to notify me if there was a response to my question. The fix was the public IP instead of the internal IP on the ACL. Sorry, this was my first time using stack overflow.
    – Dave K
    Apr 10, 2014 at 19:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.