ASA5505 Upgrade to 9.1.5 from 8.4.1 - problem with nat and accessing external host

When running on 8.4 i had a working config with the following scenario.
I have 2 interfaces configured as the outside interface.
One is connected to my internet connection
The other one is connected to a host that has a public ip.
The public host can access internet and also a PAT port on an internal host.
But after the upgrade the internal hosts can't access the external host but everything else on internet 
packet-tracer input inside tcp 10.x.x.11 1024 x.x.x.89 22
Phase: 1
Type: ACCESS-LIST
Subtype: 
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list
Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   x.x.x.0    255.255.240.0   outside
Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: drop  
Drop-reason: (nat-no-xlate-to-pat-pool) Connection to PAT address without pre-existing xlate
If i add 1 to the destination ip:
packet-tracer input inside tcp 10.x.x.11 1024 x.x.x.90 22
Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   x.x.x.0    255.255.240.0   outside
Phase: 2
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group inside_access_in in interface inside
access-list inside_access_in extended permit ip any4 any4 
Additional Information:
Phase: 3
Type: NAT
Subtype: 
Result: ALLOW
Config:
nat (inside,outside) source dynamic any interface
Additional Information:
Dynamic translate 10.x.x.11/1024 to x.x.x.80/1024
Phase: 4
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
Phase: 5
Type: IP-OPTIONS
Subtype: 
Result: ALLOW
Config:
Additional Information:
Phase: 6
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
nat (inside,outside) source dynamic any interface
Additional Information:
Phase: 7      
Type: USER-STATISTICS
Subtype: user-statistics
Result: ALLOW
Config:
Additional Information:
Phase: 8
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
Phase: 9
Type: IP-OPTIONS
Subtype: 
Result: ALLOW
Config:
Additional Information:
Phase: 10
Type: USER-STATISTICS
Subtype: user-statistics
Result: ALLOW 
Config:
Additional Information:
Phase: 11
Type: FLOW-CREATION
Subtype: 
Result: ALLOW
Config:
Additional Information:
New flow created with id 98586, packet dispatched to next module
Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: allow
Nat rules:
nat (inside,outside) source static IPv6_HOST interface service https https
nat (inside,outside) source static IPv6_HOST interface service http http
nat (inside,outside) source static IPv6_HOST interface service ssh ssh
nat (inside,outside) source static INTERNAL interface destination static EXTERNAL EXTERNAL service apcupsd apcupsd
nat (inside,outside) source static IPv6_HOST interface destination static IPv6_POP IPv6_POP
nat (inside,outside) source dynamic any interface
The EXTERNAL is the host that is connected to an outside interface and that NAT rule works ok.
I can ping the EXTERNAL host from the ASA but not from the internal network.
Any ideas would be appreciated.

Hmmm, by adding the following i got it working:
nat (inside,outside) source static IPv6_HOST interface service https https
nat (inside,outside) source static IPv6_HOST interface service http http
nat (inside,outside) source static IPv6_HOST interface service ssh ssh
nat (inside,outside) source static INTERNAL interface destination static EXTERNAL EXTERNAL service apcupsd apcupsd
nat (inside,outside) source static IPv6_HOST interface destination static IPv6_POP IPv6_POP
nat (inside,outside) source dynamic inside interface destination static EXTERNAL EXTERNAL
nat (inside,outside) source dynamic any interface
It is a bit complicated though since the EXTERNAL host get it's address via DHCP and so does the ASA.

Similar Messages

  • Problem with DNS and/or Virtual Host (works from inside, not from outside)

    I am running several web sites (as virtual hosts) successfully on one Xserve (192.168.200), which are accessible internally and from the Internet (via forwarding port 80 on our firewall).
    Now I am trying to add another web site (newmini.domain.com), which however is running on a Mac mini (also on the same subnet as the Xserve) at 192.168.100. What I did is make an additional entry under the Xserve's DNS for the domain (domain.com) (+ Machine..., pointing to 192.168.0.100). (I also made the necessary changes to the Mac mini's httpd and hosts configuration--no problem there).
    Now, here's the strange thing: All computers on the subnet, whose DNS points to the Xserve, can see and browse newmini.domain.com fine. No problem. The computers ask the Xserve for the IP of the host in question, the Xserve says, "192.168.100", the request goes to the Mac mini, and it serves the web site as expected.
    But this doesn't happen if the request comes from the Internet. Instead of seeing the Mac mini, the client sees the default web site of the Xserve... So it appears that somewhere, the virtual host part of the HTTP request is lost between our firewall and the Xserve.
    Any ideas? Thanks.

    It's not going to.
    You say you've setup port forwarding on the firewall. Port forwarding only cares about the port number (80). It knows nothing about the nature of the request (e.g. the hostname that the web request is for). Therefore all extenal connections on port 80 get sent to the XServe. The newmini doesn't see the traffic at all.
    If you only have a single public IP address you can only forward port 80 traffic to a single machine. Your options are to either use a different port number, or configure the XServe to proxy the connection to the mini (so now the traffic goes router -> XServe -> Mini -> XServe -> router), although that might not do what you want since it still places load and dependencies on the XServe.

  • Is it possible to upgrade my macbook air 13" from 1.86 GHz 128 gb flash and 2GB memory to the 2.13 GHz  256 and 4GB memory, how much would it cost?

    Is it possible to upgrade my macbook air 13" from 1.86 GHz 128 gb flash and 2GB memory to the 2.13 GHz  256 and 4GB memory, how much would it cost?

    About the only thing that "might" be able to do is upgrade the SSD. OWC sells SSD upgrades for that unit. You would have to contact Apple though to verify that no warranty issues would apply when making the upgrade.

  • I have a early 2011 Macbook pro 13 inch, I'm running Lion 10.7.4, and i want to upgrade to 10.8 Mountain Lion. Is it safe for my computer or are people experiencing problems with displays and Battery life?

    I have a early 2011 Macbook pro 13 inch, I'm running Lion 10.7.4, and i want to upgrade to 10.8 Mountain Lion. Is it safe for my computer or are people experiencing problems with displays and Battery life?
    Do Not post stuff about how Airplay doesnt work, because i dont have Apple TV and dont need to hear about it.

    If you have an external drive equal to or larger than your internal HD, clone your internal to it with either Carbon Copy Cloner or Super Duper. Test the clone to make sure it's bootable. Then upgrade either one. Try it out first.

  • Since I upgrade my iphone 3gs to ios 5.1, I have several problems with network and wi-fi, any solution?

    Since I upgrade my iphone 3gs to ios 5.1, I have several problems with network and wi-fi, any solution? (No jailbreak)
    Most of the time the iphone cannot reach any network and when it can, there is no data transfer, I can only make calls and sms.

    Skizofrenias wrote:
    Since I upgrade my iphone 3gs to ios 5.1, I have several problems with network and wi-fi, any solution? (No jailbreak)
    Most of the time the iphone cannot reach any network and when it can, there is no data transfer, I can only make calls and sms.
    iOS: Troubleshooting Wi-Fi networks and connections
    iOS: Wi-Fi or Bluetooth settings grayed out or dim

  • Problem with exporting and printing from pages to PDF

    I have a problem with my Pages
    My font will not be embeded in my pdf files.
    I have saved as a ps file and in to the destiller and my fonts are missing.
    I need to send my file to the print shop but they will not accept my file and i now understand why.
    fonts are missing...
    Is there a workaround.
    I have no problem in Indesign or quark but pages.....
    I need help
    thanks a zillion

    The font is coming from a notation software Sibelius 4 and is namned opus
    Hmmm ... Sibelius is a music notation software and notations are marked up in MusicXML. Presumably the font file is an SFNT with TrueType splines, but it is probably not installed in OS X system folders - rather in an internal Sibelius application font folder. So presumably you do not see the font in FontBook and OS X font auditing does not apply to the font.
    Sibelius exports EPS files, right? If memory serves, an EPS is still legal even if the font resource is not embedded. And in any case, we know from the behaviour that the font resource is not embedded for some reason. So how do you get Sibelius to put the font resource inside the graphic ... normally there is a button in the EPS export procedure that gives you the option to Embed All Fonts.
    You do not seem to get this button, though. Or why else would you not have checked it already and the problem would have gone away already.
    The next point in troubleshooting this is that you are not following the path that would let OS X detect that an external font resource is not embedded.
    I go from pages-print-printer- acrobat Pro 8-save as Pdf-x
    What you are doing here is telling Pages to tell OS X to generate a PostScript program within which is nested your Encapsulated PostScript program with the call to an unresolved external font resource.
    So why does Acrobat Pro not detect the unresolved external font resource? Hmm ... did you try the Preflight option in Acrobat 8 Pro? It should provide information on unresolved embeddings.
    I have also tried pages-print-printer- acrobat Pro 8 and save pdf as postscript and put the postscript file in destiller 8 pro with defalt setting high quality print
    The whole problem with EPS and PS is that this sort of situation is possible in the first place (plus, what is worse, the PS program can include custom additions to the graphics model that then fail in the PS interpreter whence Apple GX normalizing, Adobe Distiller normalizing, and Apple Quartz normalizing). You want to get as far away from EPS and PS as possible, believe me.
    So, you have not done what I posted that you should do in the first place. If I were you, I would first get rid of the problem that the EPS is making a call to an external font and then get rid of the problem that the PostScript is preserving the external call.
    To get rid of the problem that the EPS is preserving an external call, simply open the EPS in Apple Preview which includes a NORMALIZER for EPS/PS, and then save out the graphic as PDF. Alternatively, if you don't trust Quartz for some reason, set up a hotfolder for Distiller, make sure the option to embed all fonts is enabled, and convert the EPS to PDF.
    Now replace your EPS in Pages with PDF in Pages, and don't save PostScript to disk but save PDF to disk through the proper procedure which is File > Print > PDF > Save as PDF/X [for your custom configuration of the PDF/X-3 filter considering that no sane person in North Europe prints lowend US SWOP, we use ISO].
    If you begin by telling OS X that you want PDF within which fonts are supposed to be embedded ALWAYS, then you have started the right way. Otherwise, you have not told the operating system what you want to do, and this then leads you into places where you are unlikely to have the expertise to troubleshoot problems.
    So, forget placing EPS in the first place, place PDF. And forget saving PostScript to disk, save PDF to disk. If that does not sort your problem, here is the dirty solution for professional prepress.
    Adobe Photoshop has an EPS rasterizer that has wide tolerances for poor PostScript programming (so does Adobe Illustrator 6 and higher by the way).
    Therefore, if an EPS is posing problems, one workaround is to rasterize the EPS at high resolution in Photoshop and place that high resolution PDF in your layout.
    Take care that you rasterize as 1 bit at the required resolution of the print provider, probably 2450 dpi. When you save the 1 bit as PDF, Photoshop automatically compresses to a very, very small file (don't be surprised if 15Mb compresses to something like 0.5Mb).
    Rasterizing in Photoshop should not be necessary if you simply start by telling the operating system what it is you are trying to do. Then the operating system should be able to take the right decisions for you, and tell if you if finds problems it cannot resolve without turning to you.
    Good luck,
    Henrik
    would-be technical writer

  • I am not able to open iCloud from pc, error is "problem with the server". what should I do?

    I am not able to open iCloud from pc, error is "problem with the server". what should I do?

    Go to Settings>General>Restrictions>Accounts (near the bottom) and set this to Allow Changes.  You will then be able to access Settings>iCloud again.

  • I bought a new MacBook Pro several months ago.  I keep losing my wireless connection (my wife, sitting several feet from me has no problem with her iPad2).  I find the quickest fix ix to turn Airport off and back on.  Very annoying.   Suggestions please?

    I bought a new MacBook Pro several months ago.  I keep losing my wireless connection (my wife, sitting several feet from me has no problem with her iPad2).  I find the quickest fix ix to turn Airport off and back on.  Very annoying.   Suggestions please?

    What kind of wireless router are you using? more importantly which protocol are you connecting with? Are you and wife connecting using the 2.4Ghz band? or do you have a dual band router that offers the 5GHZ band?  Are you both connecting vie 802.11 a/b/g or n?
    The best thing to do is to go into SYSTEM PREFERENCES and select NETWORK, then select AIRPORT and click on the ADVANCED button.
    Under the AirPort tab you should delete all the preferred networks and only add back in your network with the proper security settings and passwords.
    If you hold down the option key on your keyboard while clicking on the airport icon at the top on your macbook pro. you'll seesome data that will tell you what band and mode you're connecting at, as well as in an indication of signal strength (RSSI) if you write down and post back that information it'll tell us what's going on.

  • Hello! im from argentina. im having problems with my iphone. can my friend take it to usa for a cheking?

    hello! im from argentina. im having problems with my iphone. can my friend take it to usa for a cheking?
    what do i need to take my iphone to an apple store? just the iphone? or the charger also? what about the ticket?
    sorry about my english

    If your phone was purchased in the US, yes. Otherwise, no. And, you only need the phone, nothing else.

  • How do i send an html file exported from muse as email blast with images and live links?

    My question it:
    How do i send an html file exported from muse as email blast with images and live links?
    I have designed a "website" in adobe muse and exported it as an html file. I am not sure how to send my .html file in an email!
    Best,
    Nicole

    Unfortunately, the answer is, you don't. The requirements for HTML displayed in an e-mail reader are very different than those for HTML displayed in a browser. The output of Muse won't work as an HTML e-mail. You could upload the Muse site as a website and provide a link to it in an e-mail, but the HTML generated by Muse is not suitable for direct display by an e-mail program.

  • I am from India using my iphone4 with Vodafone and  firmware version 5.0.1(9A405). I am unable to access 3G from my device as the CELLULAR DATA NETWORK option in the settings is missing. Any methods or options for fixing the same????

    I am from India using my iphone4 with Vodafone and  firmware version 5.0.1(9A405). I am unable to access 3G from my device as the CELLULAR DATA NETWORK option in the settings is missing. Any methods or options for fixing the same????

    I am from India using my iphone4 with Vodafone and  firmware version 5.0.1(9A405). I am unable to access 3G from my device as the CELLULAR DATA NETWORK option in the settings is missing. Any methods or options for fixing the same????

  • Since I upgraded to 10.7.2 lion I have these problems with Time Capsule. What is the problem? thanks

    since I upgraded to 10.7.2 lion I have these problems with Time Capsule. What is the problem? thanks

    Unable to access disk image backup "/ Volumes / Time Capsule / iMac Admin. Sparsebundle" (error -1).
    Then?????

  • I have a iphone 5, purchased dec 2013. Had no problems with downloads and syncing until yesterday. I updated to the latest 7.1.1 and now my purchased ringtones have bern deleted from ....Try providing more room for peoples questions ...

    I have a iphone 5, purchased dec 2013. Had no problems with downloads and syncing until yesterday. I updated to the latest 7.1.1 and now my purchased ringtones have bern deleted from my library and my phone, Where are they ????
    I have gone to download again and told i can purchase them again
    But there is no option to download all ready purchased items..
    Can you provide an explanation and solution .

    Are you using the same Apple id as used to originally purchase them
    and are you using iTunes on a PC/Mac

  • Upgrading to 6.1.1 hasn't solved the problem with network connection on 4S. Still "No Servise"!

    Upgrading to 6.1.1 hasn't solved the problem with network connection on 4S. Still "No Servise"!

    Same here.  Everything was fine running on ios 6.0, I don't know what possessed me to upgrade!  I contacted O2 and thet went through the usual settings; reboot; airplane mode etc and it works for a while (like 5 mins) then service is losted with the network.  I've even deleted the exchange email account and rebooted as read on the internet that this would fix the problem.... guest what....yep no joy!  This is clearly a faulty software update and need fixing pronto!  I've read that ios6.1.2 will be out soon to fix the firmware that was suppose to fix the initial network problem.   When will this be realeased Apple?!  It's hardly fit for purpose when I can't make calls or surf the internet. 

  • Itunes states that my computer is not authorized to download an audio book I purchased from itunes.  No problem with purchased songs however.

    Itunes states that my computer is not authorized to download an audio book I purchased from itunes.  No problem with purchased songs however.

    Hello susanserio
    Try Deauthorize your account and then Authorize the account to see if any changes occur. Also there may a resolution in the second article that can be helpful as well.
    iTunes Store: About authorization and deauthorization
    http://support.apple.com/kb/HT1420
    iTunes repeatedly prompts to authorize computer to play iTunes Store purchases
    http://support.apple.com/kb/ts1389
    Thanks for using Apple Support Communities.
    Regards,
    -Norm G.

Maybe you are looking for