|
Posted by Walter Roberson on August 24, 2007, 9:08 pm
If you were Registered and logged in, you could reply and use other advanced thread options
>I have an ASA5505 firewall, T1 in to a private IP network. Outbound
>traffic no problem, in bound TCP though not working. I have very
>little hair left after working for hours on what I'm guessing is a
>simple issue. Why can't I get TCP traffic into the hosts I've created
>ACL & Static's for? Any thoughts are appriciated, thanks.
>access-list outside_access_in extended permit tcp any host 192.168.0.99 eq www
You have to use the *public* IP addresses in the access-list that
you apply to the outside interface.
More generally, unless you have specifically configured otherwise,
if you have any traffic that needs to initiate connections from a
lower security interface to a higher security interface, then
the ACL attached to the lower security interface needs to be
written in terms of the IP address that the higher security
interface NAT or static's to with respect to that lower security
interface. (This isn't necessarily the same as the "public"
IP, because you might (for whatever reason) choose to have
your "inside" interface translate to some other address range
for communications to a DMZ.)
| 
XML site map