I still use the old command sometimes...hehe.
The mask is important in the PIX/ASA as I've demonstrated....especially for
a person that is new to the area.
Another great example is you put a host mask on a 1 to 1 static but you use
the block mask for a global pool. I've seen tons of people get confused
with that.
tv
----- Original Message -----
From: "Ryan West" <[email protected]>
To: "Tony Varriale" <[email protected]>; <[email protected]>
Sent: Wednesday, July 22, 2009 2:52 AM
Subject: RE: [c-nsp] NAT and PAT on ASA
Tony,
I agree that I chose the wrong wording here. It should have read, the ACL
you're concerned with is inbound on the outside interface. Otherwise, the
configlet is fine.
I find the netmask option to be irrelevant, unless you're falling on obvious
bit boundaries within the same class or doing NAT shifting. I guess I'm a
creature of habit and go with the path of least keystrokes. When you're
creating isakmp keys, do you type:
tunnel-group 169.254.50.50 type ipsec-l2l
tunnel-group 169.254.50.50 ipsec-attributes
pre-shared-key BestPractices
or
isakmp key BestPractices address 169.254.50.50
They both produce the same results. I guess the BU gave up on calling it a
deprecated command, it hasn't seemed to complain since 7.2.
-ryan
-----Original Message-----
From: [email protected]
[mailto:[email protected]] On Behalf Of Tony Varriale
Sent: Tuesday, July 21, 2009 10:42 PM
To: [email protected]
Subject: Re: [c-nsp] NAT and PAT on ASA
Ryan,
I would recommend completing your static with the appropriate netmask.
Also, ACLs can be applied in and out on an interface on ASA and PIX since
7.0.
tv
----- Original Message -----
From: "Ryan West" <[email protected]>
To: "Oddiraju, Kiran @ London SMC" <[email protected]>;
<[email protected]>
Sent: Tuesday, July 21, 2009 1:48 PM
Subject: Re: [c-nsp] NAT and PAT on ASA
static (inside,outside) 58.66.76.88 192.168.0.100
show run access-group
take note of the acl to the outside interface, ACLs are on the ASA are
inbound.
access-list <myaccesslist> ext permit icmp any host 58.66.76.88 echo
access-list <myaccesslist> ext permit tcp any host 58.66.76.88 eq www
-ryan
-----Original Message-----
From: [email protected]
[mailto:[email protected]] On Behalf Of Oddiraju, Kiran @
London SMC
Sent: Tuesday, July 21, 2009 2:09 PM
To: [email protected]
Subject: [c-nsp] NAT and PAT on ASA
Guys,
I am new to the ASA world, I have a bunch of external IP's from the ISP
and I have an inside host that I want to access externally. How do I
translate an inside ip (192.168.0.100) to an outside address
(58.66.76.88) on the ASA? I should be able to ping and www from outside
world to my inside host. Please let me know how to accomplish this.
Many thanks,
K
CB Richard Ellis Limited, Registered Office: St Martin's Court,
10 Paternoster Row, London, EC4M 7HP, registered in England and Wales No.
3536032.
Regulated by the RICS and an appointed representative of CB Richard Ellis
Indirect Investment Services Limited which is authorised and regulated by
the Financial Services Authority.
This communication is from CB Richard Ellis Limited or one of its
associated/subsidiary companies. This communication contains information
which is confidential and may be privileged. If you are not the intended
recipient,
please contact the sender immediately. Any use of its contents is strictly
prohibited
and you must not copy, send or disclose it, or rely on its contents in any
way whatsoever.
Reasonable care has been taken to ensure that this communication
(and any attachments or hyperlinks contained within it) is free from
computer viruses.
No responsibility is accepted by CB Richard Ellis Limited or its
associated/subsidiary
companies and the recipient should carry out any appropriate virus checks.
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
