Newsgroup: it.comp.reti.cisco
Titolo: upgrade da PIX ad ASA

Un saluto a tutti gli "abitanti" del newsgroup.
Ho sostituito un vecchio PIX501 con un ASA5510, ma sto incontrando
problemi nel fare il port forwarding... la cosa strana è che sul 501
funziona perfettamente, sull'ASA no. Ho fatto questa semplice conf di
prova:
Interfaccia Inside: 192.168.0.1
Interfaccia Outside: 10.0.10.225
Gateway Internet: 10.0.10.250
PC collegato alla Inside: 192.168.0.10
PC collegato alla Outside: 10.0.10.3
L'obiettivo è fare desktop remoto su una macchina attaccata all'inside
da una macchina attaccata all'outside.
Le righe significative sono queste:
access-list incoming extended permit tcp any host 10.0.10.225 eq 3389
log
access-list incoming extended permit ip any any log
access-list incoming extended deny ip any any log
global (outside) 1 interface
nat (inside) 1 192.168.0.0 255.255.255.0
static (inside,outside) tcp 10.0.10.225 3389 192.168.0.10 3389 netmask
255.255.255.255
access-group incoming in interface outside
route outside 0.0.0.0 0.0.0.0 10.0.10.250 1
Dopo un tentativo di desktop remoto dal pc collegato all'outside sul
pc collegato all'inside ottengo questo:
cerbero# show nat
NAT policies on Interface inside:
  match tcp inside host 192.168.0.10 eq 3389 outside any
    static translation to 
10.0.10.225/3389
    translate_hits = 0, untranslate_hits = 3
  match ip inside 192.168.0.0 255.255.255.0 inside any
    dynamic translation to pool 1 (No matching global)
    translate_hits = 0, untranslate_hits = 0
  match ip inside 192.168.0.0 255.255.255.0 outside any
    dynamic translation to pool 1 (10.0.10.225 [Interface PAT])
    translate_hits = 0, untranslate_hits = 0
cerbero# show access-list
access-list cached ACL log flows: total 2, denied 0 (deny-flow-max
4096)
            alert-interval 300
access-list incoming; 3 elements
access-list incoming line 1 extended permit tcp any host 10.0.10.225
eq 3389 log debugging interval 300 (hitcnt=0)
access-list incoming line 2 extended permit ip any any log
informational interval 300 (hitcnt=0)
access-list incoming line 3 extended deny ip any any log informational
interval 300 (hitcnt=0)
Perchè ci sono queste tre "untranslate hits"?
Allego anche la configurazione per intero (non si sa mai).
ASA Version 7.0(6)
!
hostname cerbero
enable password 2KFQnbNIdI.2KYOU encrypted
names
dns-guard
!
interface Ethernet0/0
 nameif outside
 security-level 0
 ip address 10.0.10.225 255.255.255.0
!
interface Ethernet0/1
 nameif inside
 security-level 100
 ip address 192.168.0.1 255.255.255.0
!
interface Ethernet0/2
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Ethernet0/3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Management0/0
 shutdown
 no nameif
 no security-level
 no ip address
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
access-list incoming extended permit tcp any host 10.0.10.225 eq 3389
log debugging
access-list incoming extended permit ip any any log
access-list incoming extended deny ip any any log
pager lines 24
mtu inside 1500
mtu outside 1500
no failover
asdm image disk0:/asdm506.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 192.168.0.0 255.255.255.0
static (inside,outside) tcp 10.0.10.225 3389 192.168.0.10 3389 netmask
255.255.255.255
access-group incoming in interface outside
route outside 0.0.0.0 0.0.0.0 10.0.10.250 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
http server enable
http 192.168.0.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet timeout 5
ssh timeout 5
console timeout 0
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map global_policy
 class inspection_default
  inspect dns maximum-length 512
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip
  inspect xdmcp

255.255.255.255
Prova a sostituirla con:
static (inside,outside) tcp interface 3389 192.168.0.10 3389 netmask 
255.255.255.255
Ciao,
         Tosh.


Eureka! Funziona!
Se ti capita mai di passare dalla provincia di Modena mandami una mail
che ti offro un pranzo!!! :)))
Ci ho imprecato dietro una settimana!!!
Grazie :)


Ehmm, in provincia di Modena ci vado o ci passo quasi tutti i giorni, ci ho 
preso pure un sacco di multe e ci sarei pure nato.
Ciao,
         Tosh.