<html><body><span style="font-family:Verdana; color:#000000; font-size:10pt;"><div>Hello List,</div>
<div> First let me say I'm not a heads down network guy, but I have setup several cisco firewalls from pix's some 831's, and now I'm trying to get a asa 5505 configured. ver 7.2 and 5.2 on the ASDM.</div>
<div> </div>
<div> This has been in and working for some time, granting outbound access. There is only one external useable ip address so everything is using PAT to get out, (although whoever set it up set it up like a nat with a global address pool).</div>
<div> </div>
<div> I have been trying to get an inbound static command to work, with no luck. First I wonder if I can do a static mapping for ingress on the same IP that is being used for PAT/NAT for egress. And if that is possible why can't I get through, I'm pretty sure the static command is right, and I needed to add two acl's (any to outside) (outside to inside) to get the packet trace in asdm to let the packet into the inside host, but still the translate isn't passing the packet tracing.</div>
<div> </div>
<div> Please any insight would be greatly appreciated.</div>
<div> </div>
<div>The log shows the port coming in as something different than what I expect: the 66.152.132.32/1064 should be 66.152.132.32/5900 (for vnc, which is the client I am testing with).</div>
<div> </div>
<div>These are the lines from the log:</div>
<div>>4 Jul 12 2011 11:27:13 106023 66.152.132.32 outside-ip Deny tcp src Etherpoint:66.152.132.32/1064 dst Inside:outside-ip/5900 by access-group "Etherpoint_access_in" [0x0, 0x0]<BR>>4 Jul 12 2011 11:27:07 106023 66.152.132.32 outside-ip Deny tcp src Etherpoint:66.152.132.32/1064 dst Inside:outside-ip/5900 by access-group "Etherpoint_access_in" [0x0, 0x0]<BR>>4 Jul 12 2011 11:27:04 106023 66.152.132.32 outside-ip Deny tcp src Etherpoint:66.152.132.32/1064 dst Inside:outside-ip/5900 by</div>
<div> </div>
<div>These are the appropriate lines from the config:</div>
<div>>access-list Etherpoint_access_in extended permit tcp any eq 5900 host outside-ip eq 5900 <BR>>access-list Etherpoint_access_in extended permit tcp host outside-ip eq 5900 host 192.168.125.8 eq 5900 <BR>>global (Etherpoint) 2 interface<BR>>nat (Inside) 0 access-list Inside_nat0_outbound<BR>>nat (Inside) 2 192.168.125.0 255.255.255.0<BR>>static (Inside,Etherpoint) tcp interface 5900 192.168.125.8 5900 netmask 255.255.255.255 <BR>>no threat-detection statistics tcp-intercept<BR>>access-group Inside_access_in in interface Inside<BR>>access-group Etherpoint_access_in in interface Etherpoint<BR></div>
<div>Thanks In Advance</div>
<div>Bill Kruchas</div></span></body></html>