Static NAT - SA540

Regarding the SA540, Can you can set a statically NAT’d private IP to go outbound on the same Public IP instead of the general one.  Specifically, 184.183.11.224 routes to 192.168.1.5 and 184.183.11.225 routes to 192.168.1.4.  Currently, 192.168.1.5 goes outbound as 184.183.11.224 and 192.168.1.4 goes outbound as 184.183.11.225.  My concern is that the SA-540 isn’t capable of making the latter happen and all outbound communication from 192.168.1.4 and 192.168.1.5 will gout as the Public IP of the router itself (184.183.11.223).
Can anyone answer this for me?

Today we have the same problem,basically we have two public addresses one for internal network another one for mail server.the problem was that we could not inbound from ip address of mail server to alias ip address(not address from main wan interface)
mail server internal ip-------SA540(ip alias address)------internet
network------sa540(main wan interface address)---internet
The solution was to reset to factory defaults and doing the firewall rules for mail server first,i guess somehow SA540 remember old settings(no clear xslate) mostly because of iptables rules or....

Similar Messages

  • Static NAT to two servers using same port

    I have a small office network with a single public IP address. Currently we have a static nat for port 443 for the VPN. We just received new software that requires the server the software is on to be listening on port 443 across the internet. Thus, essentially I need to do natting (port forwarding) using port 443 to two different servers.
    I believe that the usual way to accomplish this would be to have the second natting use a different public facing port, natted to 443 on the inside of the network (like using port 80 and 8080 for http). But, if the software company says that it must use port 443, is there any other way to go about this? If, for example, I know the IP address that the remote server will be connecting to our local server on, is there any way to add the source IP address into the rule? Could it work like, any port 443 traffic also from x.x.x.x, forward to local machine 192.168.0.2. Forward all other port 443 traffic not from x.x.x.x to 192.168.0.3.
    Any help would be very much appreciated.
    Thanks,
    - Mike                  

    Hi,
    Using the same public/mapped port on software levels 8.2 and below would be impossible. Only one rule could apply. I think the Cisco FWSM accepts the second command while the ASA to my understanding simply rejects the second "static" statement with ERROR messages.
    On the software levels 8.3 and above you have a chance to build a rule for the same public/mapped port WHEN you know where the connections to the other overlapping public/mapped port is coming from. This usually is not the case for public services but in your situation I gather you know the source address where connections to this server are going to come from?
    I have not used this in production and would not wish to do so. I have only done a simple test in the past for a CSC user. I tested mapping port TCP/5900 for VNC twice while defining the source addresses the connections would be coming from in the "nat" configuration (8.4 software) and it seemed to work. I am not all that certain is this a stable solution. I would imagine it could not be recomended for a production environment setup.
    But nevertheless its a possibility.
    So you would need the newer software on your firewall but I am not sure what devce you are using and what software its using.
    - Jouni

  • How to configure Multiple static NATs

    Hi,
    I am trying to configure a Cisco 871 router.
    I have 3 servers on my network that need static public IPs but also still need to communicate on the local network.
    I have given my WAN interface the first IP in the block and set up PAT for the rest of the computers on the network which is working fine. Next I set up static NAT rules for the servers translating 3 of the remaining public IPs to the internal addresses of the servers.
    I can access those servers internally using the public IPs but not from outside the network. A tracroute from outside the network gets dropped when it gets to my ISP.
    I've never configured more than one static ip for a network before and i know i've just missed a step here. Do I also need to set up static routes? Will that update the next hop's routing table?
    Thanks in advance for any help.

    You can execute multiple apply processes ( parallel parameter ). It is pretty much scalable.
    There is one thing why 2 propagate processes can be helpfull: I consulted one client with different reqs for replication delivery for different tables. In this case you can create 2 propagate processes in different schemas (with different db links).
    For maitainence point of view one propagation and one apply is better
    Regards,
    SergeR

  • ASA 5510 Multiple Public IP - Static NAT Issue - Dynamic PAT - SMTP

    Running into a little bit of a roadblock and hoping someone can help me figure out what the issue is.  My guess right now is that it has something to do with dynamic PAT.
    Essentially, I have a block of 5 static public IP's.  I have 1 assigned to the interface and am using another for email/webmail.  I have no problems accessing the internet, receving emails, etc...  The issue is that the static NAT public IP for email is using the outside IP instead of the one assigned through the static NAT.  I would really appreciate if anyone could help shed some light as to why this is happening for me.  I always thought a static nat should take precidence in the order of things.
    Recap:
    IP 1 -- 10.10.10.78 is assigned to outside interface.  Dynamic PAT for all network objects to use this address when going out.
    IP 2 -- 10.10.10.74 is assgned through static nat to email server.  Email server should respond to and send out using this IP address.
    Email server gets traffic from 10.10.10.74 like it is supposed to, but when sending out shows as 10.10.10.78 instead of 10.10.10.74.
    Thanks in advance for anyone that reads this and can lend a hand.
    - Justin
    Here is my running config (some items like IP's, domain names, etc... modified to hide actual values; ignore VPN stuff -- still work in progress):
    ASA Version 8.4(3)
    hostname MYHOSTNAME
    domain-name MYDOMAIN.COM
    enable password msTsgJ6BvY68//T7 encrypted
    passwd msTsgJ6BvY68//T7 encrypted
    names
    interface Ethernet0/0
    speed 100
    duplex full
    nameif outside
    security-level 0
    ip address 10.10.10.78 255.255.255.248
    interface Ethernet0/1
    nameif inside
    security-level 100
    ip address 192.168.2.2 255.255.255.0
    interface Ethernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface Ethernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    management-only
    boot system disk0:/asa843-k8.bin
    ftp mode passive
    clock timezone CST -6
    clock summer-time CDT recurring
    dns server-group DefaultDNS
    domain-name MYDOMAIN.COM
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network inside-network
    subnet 192.168.2.0 255.255.255.0
    object network Email
    host 192.168.2.7
    object network Webmail
    host 192.168.2.16
    object network WebmailSecure
    host 192.168.2.16
    access-list inside_access_out extended permit ip any any
    access-list inside_access_out extended permit icmp any any
    access-list VPN_Split_Tunnel_List remark The corporate network behind the ASA (inside)
    access-list VPN_Split_Tunnel_List standard permit 192.168.2.0 255.255.255.0
    access-list outside_access_in extended deny icmp any any
    access-list outside_access_in extended permit tcp any object Email eq smtp
    access-list outside_access_in extended permit tcp any object Webmail eq www
    access-list outside_access_in extended permit tcp any object WebmailSecure eq https
    pager lines 24
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    mtu management 1500
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-647.bin
    asdm history enable
    arp timeout 14400
    nat (inside,outside) source static inside-network inside-network destination static inside-network inside-network no-proxy-arp route-lookup
    object network obj_any
    nat (inside,outside) dynamic interface
    object network Email
    nat (inside,outside) static 10.10.10.74 service tcp smtp smtp
    object network Webmail
    nat (inside,outside) static 10.10.10.74 service tcp www www
    object network WebmailSecure
    nat (inside,outside) static 10.10.10.74 service tcp https https
    access-group outside_access_in in interface outside
    access-group inside_access_out out interface inside
    route outside 0.0.0.0 0.0.0.0 10.10.10.73 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server MYDOMAIN protocol kerberos
    aaa-server MYDOMAIN (inside) host 192.168.2.8
    kerberos-realm MYDOMAIN.COM
    aaa-server MYDOMAIN (inside) host 192.168.2.9
    kerberos-realm MYDOMAIN.COM
    aaa-server MY-LDAP protocol ldap
    aaa-server MY-LDAP (inside) host 192.168.2.8
    ldap-base-dn DC=MYDOMAIN,DC=com
    ldap-group-base-dn DC=MYDOMAIN,DC=com
    ldap-scope subtree
    ldap-naming-attribute sAMAccountName
    ldap-login-password *****
    ldap-login-dn CN=SOMEUSER,CN=Users,DC=MYDOMAIN,DC=com
    server-type microsoft
    aaa-server MY-LDAP (inside) host 192.168.2.9
    ldap-base-dn DC=MYDOMAIN,DC=com
    ldap-group-base-dn DC=MYDOMAIN,DC=com
    ldap-scope subtree
    ldap-naming-attribute sAMAccountName
    ldap-login-password *****
    ldap-login-dn CN=SOMEUSER,CN=Users,DC=MYDOMAIN,DC=com
    server-type microsoft
    user-identity default-domain LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 management
    http 192.168.2.0 255.255.255.0 inside
    http redirect outside 80
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map inside_map interface inside
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment self
    email [email protected]
    subject-name CN=MYHOSTNAME
    ip-address 10.10.10.78
    proxy-ldc-issuer
    crl configure
    crypto ca certificate chain ASDM_TrustPoint0
    certificate e633854f
        30820298 30820201 a0030201 020204e6 33854f30 0d06092a 864886f7 0d010105
        0500305e 31143012 06035504 03130b47 46472d53 55532d41 53413146 301a0609
        2a864886 f70d0109 08130d39 382e3130 302e3232 322e3738 30280609 2a864886
        f70d0109 02161b47 46472d53 55532d41 53412e47 46472d50 4541424f 44592e43
        4f4d301e 170d3132 30343131 30373431 33355a17 0d323230 34303930 37343133
        355a305e 31143012 06035504 03130b47 46472d53 55532d41 53413146 301a0609
        2a864886 f70d0109 08130d39 382e3130 302e3232 322e3738 30280609 2a864886
        f70d0109 02161b47 46472d53 55532d41 53412e47 46472d50 4541424f 44592e43
        4f4d3081 9f300d06 092a8648 86f70d01 01010500 03818d00 30818902 818100b4
        aa6e27de fbf8492b 74ba91aa e0fd8361 e0e85a31 f95c380d 6e5f43ac a695a810
        f50e893b 82b91870 a32f7e38 8f392607 7a69c814 36a71a9c 2dccca07 24fe7f88
        0f3451ed c64e85fc 8359c87e 62ebf166 0a570ac5 f9f1c64b 262eca66 ea05ab65
        78da1ac2 9867a115 b14a6ba1 cd82d04e 00fc6557 856f7c04 ab1b08a0 b9de8b02
        03010001 a3633061 300f0603 551d1301 01ff0405 30030101 ff300e06 03551d0f
        0101ff04 04030201 86301f06 03551d23 04183016 801430cf 97ef92bb 678e3ba3
        0002069c 8130550a 2664301d 0603551d 0e041604 1430cf97 ef92bb67 8e3ba300
        02069c81 30550a26 64300d06 092a8648 86f70d01 01050500 03818100 64c403bd
        d75717ab 24383e77 63e10ba7 4fdef625 73c5a952 19ceecbd 75bd23ca 86dc0298
        e6693a8a 2c7fb85f 096497a7 8d784ada a433ee0d d88e9219 f0615f3c 7814bf1c
        5b4fe847 7d8894eb 18fe2da7 05f15ae9 bc2c17ec 3a7831ee f95d6ced 4799fba2
        781c8228 48224843 dc07ebb5 d20abf2a b68cfa62 ac71a41b 1196a018
      quit
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside client-services port 443
    crypto ikev2 enable inside client-services port 443
    crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
    crypto ikev1 policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet 192.168.2.0 255.255.255.0 inside
    telnet 192.168.1.0 255.255.255.0 management
    telnet timeout 20
    ssh timeout 5
    console timeout 0
    management-access inside
    dhcpd address 192.168.1.2-192.168.1.254 management
    dhcpd enable management
    threat-detection basic-threat
    threat-detection statistics
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
    ntp server 192.168.2.8 source inside prefer
    ssl trust-point ASDM_TrustPoint0 inside
    ssl trust-point ASDM_TrustPoint0 outside
    webvpn
    enable outside
    enable inside
    anyconnect-essentials
    anyconnect image disk0:/anyconnect-win-3.0.5080-k9.pkg 1
    anyconnect profiles VPN_client_profile disk0:/VPN_client_profile.xml
    anyconnect enable
    tunnel-group-list enable
    group-policy DfltGrpPolicy attributes
    vpn-tunnel-protocol ikev1 l2tp-ipsec
    group-policy GroupPolicy_VPN internal
    group-policy GroupPolicy_VPN attributes
    wins-server value 192.168.2.8 192.168.2.9
    dns-server value 192.168.2.8 192.168.2.9
    vpn-filter value VPN_Split_Tunnel_List
    vpn-tunnel-protocol ikev2 ssl-client
    group-lock value VPN
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value VPN_Split_Tunnel_List
    default-domain value MYDOMAIN.COM
    webvpn
      anyconnect profiles value VPN_client_profile type user
    group-policy GroupPolicy-VPN-LAPTOP internal
    group-policy GroupPolicy-VPN-LAPTOP attributes
    wins-server value 192.168.2.8 192.168.2.9
    dns-server value 192.168.2.8 192.168.2.9
    vpn-filter value VPN_Split_Tunnel_List
    vpn-tunnel-protocol ikev2
    group-lock value VPN-LAPTOP
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value VPN_Split_Tunnel_List
    default-domain value MYDOMAIN.COM
    webvpn
      anyconnect profiles value VPN_client_profile type user
    tunnel-group VPN type remote-access
    tunnel-group VPN general-attributes
    authentication-server-group MYDOMAIN
    default-group-policy GroupPolicy_VPN
    dhcp-server 192.168.2.8
    dhcp-server 192.168.2.9
    dhcp-server 192.168.2.10
    tunnel-group VPN webvpn-attributes
    group-alias VPN enable
    tunnel-group VPN-LAPTOP type remote-access
    tunnel-group VPN-LAPTOP general-attributes
    authentication-server-group MY-LDAP
    default-group-policy GroupPolicy-VPN-LAPTOP
    dhcp-server 192.168.2.8
    dhcp-server 192.168.2.9
    dhcp-server 192.168.2.10
    tunnel-group VPN-LAPTOP webvpn-attributes
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
    class class-default
      user-statistics accounting
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    hpm topN enable
    Cryptochecksum:951faceacf912d432fc228ecfcdffd3f

    Hi ,
    As per you config :
    object network obj_any
    nat (inside,outside) dynamic interface
    object network Email
    nat (inside,outside) static 10.10.10.74 service tcp smtp smtp
    object network Webmail
    nat (inside,outside) static 10.10.10.74 service tcp www www
    object network WebmailSecure
    nat (inside,outside) static 10.10.10.74 service tcp https https
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network inside-network
    subnet 192.168.2.0 255.255.255.0
    object network Email
    host 192.168.2.7
    object network Webmail
    host 192.168.2.16
    object network WebmailSecure
    host 192.168.2.16
    The flows from email server ( 192.168.2.7 ) , will be NATed to 10.10.10.74, only if the source port is TCP/25. Any other souce port will use the interface IP for NAT.
      Are you saying that this is not happening ?
    Dan

  • Static-nat and vpn tunnel bound traffic from same private address?

    Hi guys,
    I have site-to-site tunnel local host @192.168.0.250 and remote-host @172.16.3.3.
    For this local host @192.168.0.250, I also have a static one-to-one private to public.
    static (mgmt-192,outside-50) 216.9.50.250 192.168.0.250 netmask 255.255.255.255
    As you can see, IPSec SA shows end-points in question and traffic is being decrypted but not encrypted host traffic never enter into the tunnel, why?
    How can I resolve this problem, without complicating the setup ?
    BurlingtonASA1# packet-tracer input mgmt-192 icmp 192.168.0.250 8 0 172.16.3.3
    Phase: 1
    Type: CAPTURE
    Subtype: 
    Result: ALLOW
    Config:
    Additional Information:
    MAC Access list
    Phase: 2
    Type: ACCESS-LIST
    Subtype: 
    Result: ALLOW
    Config:
    Implicit Rule
    Additional Information:
    MAC Access list
    Phase: 3
    Type: ROUTE-LOOKUP
    Subtype: input
    Result: ALLOW
    Config:
    Additional Information:
    in   0.0.0.0         0.0.0.0         outside-50
    Phase: 4
    Type: ROUTE-LOOKUP
    Subtype: input
    Result: ALLOW
    Config:
    Additional Information:
    in   192.168.0.0     255.255.255.0   mgmt-192
    Phase: 5
    Type: ACCESS-LIST
    Subtype: log
    Result: ALLOW
    Config:
    access-group mgmt_intf in interface mgmt-192
    access-list mgmt_intf extended permit icmp any any 
    access-list mgmt_intf remark *** Permit Event02 access to DMZ Intf ***
    Additional Information:
    Phase: 6
    Type: IP-OPTIONS
    Subtype: 
    Result: ALLOW
    Config:
    Additional Information:
    Phase: 7
    Type: INSPECT
    Subtype: np-inspect
    Result: ALLOW
    Config:
    Additional Information:
    Phase: 8
    Type: NAT-EXEMPT
    Subtype: 
    Result: ALLOW
    Config:
    nat-control
      match ip mgmt-192 host 192.168.0.250 outside-50 host 172.16.3.3
        NAT exempt
        translate_hits = 5, untranslate_hits = 0
    Additional Information:
    Phase: 9
    Type: NAT
    Subtype: 
    Result: ALLOW
    Config:
    static (mgmt-192,outside-50) 216.9.50.250 192.168.0.250 netmask 255.255.255.255 
    nat-control
      match ip mgmt-192 host 192.168.0.250 outside-50 any
        static translation to 216.9.50.250
        translate_hits = 25508, untranslate_hits = 7689
    Additional Information:
    Phase: 10
    Type: NAT
    Subtype: host-limits
    Result: ALLOW
    Config:
    static (mgmt-192,dmz2-172) 192.168.0.0 192.168.0.0 netmask 255.255.255.0 
    nat-control
      match ip mgmt-192 192.168.0.0 255.255.255.0 dmz2-172 any
        static translation to 192.168.0.0
        translate_hits = 28867754, untranslate_hits = 29774713
    Additional Information:
    Phase: 11
    Type: VPN
    Subtype: encrypt
    Result: ALLOW
    Config:
    Additional Information:
    Phase: 12
    Type: FLOW-CREATION
    Subtype: 
    Result: ALLOW
    Config:
    Additional Information:
    New flow created with id 1623623685, packet dispatched to next module
    Result:
    input-interface: mgmt-192
    input-status: up
    input-line-status: up
    output-interface: outside-50
    output-status: up
    output-line-status: up
    Action: allow
    BurlingtonASA1# 
    Crypto map tag: map1, seq num: 4, local addr: 216.9.50.4
          access-list newvpn extended permit ip host 192.168.0.250 host 172.16.3.3 
          local ident (addr/mask/prot/port): (192.168.0.250/255.255.255.255/0/0)
          remote ident (addr/mask/prot/port): (172.16.3.3/255.255.255.255/0/0)
          current_peer: 216.9.62.4
          #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
          #pkts decaps: 53, #pkts decrypt: 53, #pkts verify: 53
          #pkts compressed: 0, #pkts decompressed: 0
          #pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
          #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
          #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
          #send errors: 0, #recv errors: 0
          local crypto endpt.: 216.9.50.4, remote crypto endpt.: 216.9.62.4
          path mtu 1500, ipsec overhead 74, media mtu 1500
          current outbound spi: 37CA63F1
          current inbound spi : 461C843C
        inbound esp sas:
          spi: 0x461C843C (1176273980)
             transform: esp-aes-256 esp-sha-hmac no compression 
             in use settings ={L2L, Tunnel, }
             slot: 0, conn_id: 77398016, crypto-map: map1
             sa timing: remaining key lifetime (kB/sec): (3914997/25972)
             IV size: 16 bytes
             replay detection support: Y
             Anti replay bitmap: 
              0x003FFFFF 0xFFFFFFFF
        outbound esp sas:
          spi: 0x37CA63F1 (936010737)
             transform: esp-aes-256 esp-sha-hmac no compression 
             in use settings ={L2L, Tunnel, }
             slot: 0, conn_id: 77398016, crypto-map: map1
             sa timing: remaining key lifetime (kB/sec): (3915000/25972)
             IV size: 16 bytes
             replay detection support: Y
             Anti replay bitmap: 
              0x00000000 0x00000001

    Hi
    intersting VPN ACL
    object-group network DM_INLINE_NETWORK_18
         network-object YYY.YYY.YYY.0 255.255.255.0
    object-group network DM_INLINE_NETWORK_22
    network-object UUU.UUU.UUU.0 255.255.255.0
    access-list outside_access_in extended permit ip object-group DM_INLINE_NETWORK_22 object-group DM_INLINE_NETWORK_18
    Static NAT
    static (Inside,outside) XXX.XXX.XXX.171 YYY.YYY.YYY.39 netmask 255.255.255.255
    No NAT
    object-group network DM_INLINE_NETWORK_20
    network-object UUU.UUU.UUU.0 255.255.255.0
    access-list Inside_nat0_outbound extended permit ip ZZZ.ZZZ.ZZZ.0 255.255.255.0 object-group DM_INLINE_NETWORK_20
    VPN CLient Pool
    No pool configured as it uses the interesting traffic or protected traffic in ASDM - UUU.UUU.UUU.0 is the IP address range at the far side of the site to site VPN.
    I hope this helps
    Thanks

  • NAT issue - (over same link) static-NAT works but PAT (for rest of hosts) does not !

    Hello fellow engineers!
    I have a puzzling situation implementing an Internet routing pilot project and I need someone with a fresh look at the matter because I cannot make-out what the problem is…
    Scenario description:
    2901 router with two (one used) DSL intf’s on board and its two GE ports connected to a switch via Port-Channel sub-int’f (router-on-a-stick is implemented).    The router has two other WAN (Internet) connections via a Satelite link and a MetroEthernet link.   These two are terminated on the switch on intf’s at the appropriate VLAN’s.   At attached topology scheme I depict them all collocated on the router for “simplicity” (logical topology) since the router has intf’s at the corresponding networks.   The aDSL and Metro links have an 8-IP public set, each.
    Most servers/hosts utilize VLAN 10 (int port-channel 1.10) but they need to forward their internet traffic to corresponding Internet links so PBR is used.    VLAN/subnet (all /24) pairs are:
    VLAN 11 -> 10.0.1.x
    VLAN 12 -> 10.0.2.x
    VLAN 13 -> 10.0.3.x
    VLAN 71 -> 192.168.17.x
    VLAN 204 -> 172.16.204.x
    and – last but not least ! – VLAN 10 -> 10.0.0.x
    All servers use static 1-1 NAT while all other hosts/PC’s use the Metro link (PAT).
    Situation: All PBR rules and static NAT’s of VLAN 10 behave as expected.   So does the PAT for hosts of all other VLAN’s (11, 12, 13, …).   The rest of the hosts of VLAN 10, i.e. PC’s with IP’s 10.0.0.x (in red), cannot get to the Internet !
    What is puzzling is that traffic is matched (by ACL) and NAT does occur but all I see (via “sh ip nat tra”) are the translations of the DNS requests !   Nothing else !   To top that, tracerouting a public IP does lead to the target but when hitting that same public IP (not by name) on the browser can’t load the page !
    Could pls someone spot what I’m missing !!
    To help you I also attach the router config and some command outputs…
    All help is appreciated.
    Thanx
    Costas

    That last PBR statement
    (route-map 10.0.0.X_hosts_PBR permit 70
     description *** rest of 10.0.0.x net --> Oxygen ***
     match ip address rest_of_10.0.0.x
     set ip next-hop 212.251.64.153)
    was not there in the first place - I got it there assuming it would help but it didn't.   Actually - as mentioned - it does not get any hits !
    (route-map 10.0.0.X_hosts_PBR, permit, sequence 255
      Match clauses:
        ip address (access-lists): rest_of_10.0.0.x
      Set clauses:
        ip next-hop 212.251.64.153
      Policy routing matches: 0 packets, 0 bytes)

  • Static NAT pass-through; can not get to work

    I am not having any luck getting a static NAT pass-through to work.
    BM3.8/NW6.5 all patched to the latest patches (no betas). IPFLT is NOT
    loaded.
    My internal network on one LAN all have 10.100.xxx.xxx private addresses.
    Dynamic NAT works great.
    I have secondary public IP addresses bound to my public NIC. Static NAT
    mapping between the secondary public IP addresses and the couple of
    individual private addresses work just fine. In other words, all has been
    working fine.
    I need to give one of those internal resources its public IP address
    (change it's private to its public).
    OK, I went into the NAT table and changed the proper public <-> private to
    public <-> public (identical addresses). I changed the internal computer
    to it's public address/mask with the same default gateway the server is
    using. The internal computer can now only ping itself; can't even ping
    it's default gateway. I did reinitialize, and also restarted. I can not
    get the pass-through connection to work.
    Any thoughts will be well received.
    Bob

    Robert,
    It appears that in the past few days you have not received a response to your
    posting. That concerns us, and has triggered this automated reply.
    Has your problem been resolved? If not, you might try one of the following options:
    - Visit http://support.novell.com and search the knowledgebase and/or check all
    the other self support options and support programs available.
    - You could also try posting your message again. Make sure it is posted in the
    correct newsgroup. (http://support.novell.com/forums)
    Be sure to read the forum FAQ about what to expect in the way of responses:
    http://support.novell.com/forums/faq_general.html
    If this is a reply to a duplicate posting, please ignore and accept our apologies
    and rest assured we will issue a stern reprimand to our posting bot.
    Good luck!
    Your Novell Product Support Forums Team
    http://support.novell.com/forums/

  • Static nat and service port groups

    I need some help with opening ports on my ASA using firmware 9.1.2.
    I read earlier today that I can create service groups and tie ports to those.  But how do I use those instead of using 'object network obj-ExchangeSever-smtp' ? 
    I have the ACL -
    access-list incoming extended permit tcp any object-group Permit-1.1.1.1 interface outside
    Can this statement
    object network obj-ExchangeSever-smtp
    nat (inside,outside) static interface service tcp smtp smtp
    reference the service port groups instead? 
    Thanks,
    Andrew

    Hi,
    Are you looking a way to group all the ports/services you need to allow from the external network to a specific server/servers?
    Well you can for example configure this kind of "object-group"
    object-group service SERVER-PORTS
    service-object tcp destination eq www
    service-object tcp destination eq ftp
    service-object tcp destination eq https
    service-object icmp echo
    access-list OUTSIDE-IN permit object-group SERVER-PORTS any object
    The above would essentially let you use a single ACL rule to allow multiple ports to a server or a group of servers. (Depending if you use an "object" or "object-group" to tell the destination address/addresses)
    I am not sure how you have configured your NAT. Are they all Static PAT (Port Forward) configurations like the one you have posted above or perhaps Static NAT configurations?
    You can use the "object network " created for the NAT configuration in the above ACL rule destination field to specify the host to which traffic will be allowed to. Using the "object" in the ACL doesnt tell the ASA the ports however. That needs to be configured in the above way or in your typical way.
    Hope this helps
    - Jouni

  • Static NAT causes unable to access server via internal IP

    Hi all,
    Need some help. I running site-to-site IPsec VPN in Cisco 2811 IOS 12.4 both site. Here I encounter a problem to access server on  Site A from Site B
    Site A having Leased Line connected to router with Public IP. I have done static mapping 1 web server to Public IP (NAT). This to allow external users to access the server via Public IP. At the same time, users at Site B would need to access to same server via Internal IP since they have Site-to-Site VPN established. But once I done Static Mapping (NAT), user at Site B unable to access the server at Site A using its internal IP. But external user can access server via Public IP. What went wrong here. Do i need to add extra command to get this done? We really need this.

    Hi sheik,
    I'm accessing the server form Site B using its server's LAN IP.
    If I remove the static NAT statement from my router at Site A, everything works well. I can access the server from site B using its LAN IP via Site-to-Site VPN. But in this case, external users unable to access server via Public IP since no Static NAT statement.

  • Static NAT seems to stop working

    I am running Novell SBS 6.0 sp4 servers, one with Border Manager 3.6 sp2.
    On my Border Manager server I am running two public IP's with different
    subnets on the same Netcard. For some reason my static NAT will quit
    working until I bounce the server. What could cause this? It seems as
    though it will do it if my Internet connection is lost for a split second.
    The IP that is not done through static NAT has not failed yet.
    Just wondering,
    [email protected]

    > I am running Novell SBS 6.0 sp4 servers, one with Border Manager 3.6
    sp2.
    > On my Border Manager server I am running two public IP's with different
    > subnets on the same Netcard. For some reason my static NAT will quit
    > working until I bounce the server. What could cause this? It seems as
    > though it will do it if my Internet connection is lost for a split
    second.
    > The IP that is not done through static NAT has not failed yet.
    >
    > Just wondering,
    > [email protected]
    What ever was happening must have cleared it's self up. The Static NAT
    has been running without problem now.
    Sorry for the posting,
    [email protected]

  • Static nat using gloabl ip

    I have an ASA configured with a server in our DMZ.
    It is currently configured to be accessed via the internet on port 80.  That works.
    Now they want to initiate traffic from the DMZ to the internet. 
    I thought the static NAT would keep the IP.  Its actually a No-nat.
    We have registered IPs on the DMZ and wanted to use them for the internet.
    I am seeing that when the server initiates communication to the internet it is picking up a global address from the global (outside) 1 x.x.230.1-x.x230.254.
    Below is my current configuration.
    (these first 2 lines allow access from outside to inside)
    access-list acl_out extended permit tcp any host x.x.73.91 eq www
    static (dmz1,outside) x.x.73.91 143.101.73.91 netmask 255.255.255.255
    global (outside) 1 x.x.230.1-x.x.230.254
    If i do a show xlate
    it shows:
    global x.x.73.91 local x.x.73.91
    Which is why I thought I did not need to do anything to initiate from the dmz1 interface to outside!

    FW1(config)# sh run
    : Saved
    ASA Version 8.2(1)
    hostname FW1
    names
    dns-guard
    interface GigabitEthernet0/0
    nameif outside
    security-level 0
    ip address x.x.6.4 255.255.255.0
    interface GigabitEthernet0/1
    speed 100
    duplex full
    nameif inside
    security-level 100
    ip address 172.25.1.2 255.255.255.0
    interface GigabitEthernet0/2
    speed 100
    duplex full
    nameif dmz1 
    security-level 25
    ip address x.x.0.5 255.255.255.0
    interface GigabitEthernet0/3
    speed 100
    duplex full
    nameif ServProv
    security-level 50
    ip address x.x.13.2 255.255.255.0
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    management-only
    boot system disk0:/asa822-k8.bin
    boot system disk0:/asa821-k8.bin
    ftp mode passive
    object-group icmp-type ICMP
    icmp-object echo
    icmp-object echo-reply
    icmp-object unreachable
    icmp-object time-exceeded
    object-group network WEB-Servers
    access-list acl_out extended permit tcp any host x.x.250.18 eq https
    access-list acl_out extended permit tcp any host x.x.250.18 eq www
    access-list acl_out extended permit tcp any host x.x.250.70 eq www
    access-list acl_out extended permit udp any host x.x.112.2 eq domain
    access-list acl_out extended permit tcp any host x.x.112.2 eq domain
    access-list acl_out extended permit udp any host x.x.112.2 eq ntp
    output - suppressed
    access-list acl_dmz1 extended permit ip host x.x.75.90 172.24.28.0 255.255.255.0
    access-list acl_dmz1 extended permit ip host x.x.75.91 172.24.28.0 255.255.255.0
    access-list acl_dmz1 extended permit ip host x.x.75.90 172.24.73.0 255.255.255.0
    access-list acl_dmz1 extended permit ip host x.x.75.91 172.24.73.0 255.255.255.0
    access-list acl_dmz1 extended permit ip any 172.24.172.0 255.255.255.0
    access-list acl_dmz1 extended permit ip any 172.24.17.0 255.255.255.0
    access-list acl_dmz1 extended permit ip host x.x.250.18 172.24.21.0 255.255.255.0
    access-list acl_dmz1 extended permit ip host x.x.250.18 172.24.28.0 255.255.255.0
    access-list acl_dmz1 extended permit ip any host x.y.32.10
    access-list acl_dmz1 extended permit ip any 172.24.20.0 255.255.255.0
    access-list acl_dmz1 extended permit ip any 172.24.28.0 255.255.255.0
    access-list acl_dmz1 extended permit ip any host 172.25.248.12
    access-list acl_dmz1 extended permit ip x.x.125.0 255.255.255.0 10.11.17.0 255.255.255.0
    access-list acl_dmz1 extended permit ip x.x.125.0 255.255.255.0 10.25.125.0 255.255.255.0
    access-list acl_dmz1 extended permit ip x.x.130.0 255.255.255.0 10.25.125.0 255.255.255.0
    access-list acl_dmz1 extended permit ip x.x.130.0 255.255.255.0 10.11.17.0 255.255.255.0
    access-list acl_dmz1 extended permit tcp host x.x.75.142 host 172.24.76.76 eq 5000
    access-list acl_dmz1 extended deny tcp any any eq 5000
    access-list acl_dmz1 extended deny udp any any eq 1434
    access-list acl_dmz1 extended deny udp any any eq 3127
    access-list acl_dmz1 extended deny tcp any any eq 6346
    access-list acl_dmz1 extended deny tcp any any eq 6699
    access-list acl_dmz1 extended deny udp any any eq 1214
    access-list acl_dmz1 extended deny ip any host 63.210.247.160
    access-list acl_dmz1 extended deny ip any host 208.49.21.95
    access-list acl_dmz1 extended deny ip any host 165.254.12.201
    access-list acl_dmz1 extended deny ip any host 130.94.92.113
    access-list acl_dmz1 extended deny ip any host 216.235.81.6
    access-list acl_dmz1 extended deny ip any host 212.187.204.47
    access-list acl_dmz1 extended deny ip any host 66.151.128.9
    access-list acl_dmz1 extended deny ip any 64.124.45.0 255.255.255.0
    access-list acl_dmz1 extended permit tcp any 172.24.0.0 255.255.0.0 eq 135
    access-list acl_dmz1 extended permit tcp any 172.25.248.0 255.255.254.0
    access-list acl_dmz1 extended permit tcp any 128.191.0.0 255.255.0.0 eq 135
    access-list acl_dmz1 extended permit tcp any x.y.0.0 255.255.0.0 eq 135
    access-list acl_dmz1 extended permit tcp any 157.123.0.0 255.255.0.0 eq 135
    access-list acl_dmz1 extended permit tcp x.x.124.0 255.255.255.0 172.26.128.0 255.255.128.0
    access-list acl_dmz1 extended permit tcp 172.16.64.0 255.255.255.0 172.26.128.0 255.255.128.0
    access-list acl_dmz1 extended deny udp any any eq 135
    access-list acl_dmz1 extended deny tcp any any eq 135
    access-list acl_dmz1 extended deny udp any any eq 445
    access-list acl_dmz1 extended deny tcp any any eq 138
    access-list acl_dmz1 extended deny udp any any eq 139
    access-list acl_dmz1 extended deny udp any any eq 2110
    access-list acl_dmz1 extended deny tcp any any eq 2110
    access-list acl_dmz1 extended deny tcp any any eq 3410
    access-list acl_dmz1 extended permit tcp any host 172.24.20.60 eq smtp
    access-list acl_dmz1 extended permit tcp host x.x.75.46 any eq smtp
    access-list acl_dmz1 extended permit tcp host x.x.250.22 any eq smtp
    access-list acl_dmz1 extended permit tcp host x.x.250.61 any eq smtp
    access-list acl_dmz1 extended permit tcp host x.x.112.2 any eq smtp
    access-list acl_dmz1 extended permit tcp host x.x.0.20 any eq smtp
    access-list acl_dmz1 extended permit tcp host x.x.0.21 any eq smtp
    access-list acl_dmz1 extended permit tcp host x.w.66.58 any eq smtp
    access-list acl_dmz1 extended deny tcp any any eq 465
    access-list acl_dmz1 extended permit tcp x.x.250.0 255.255.255.0 any eq smtp
    access-list acl_dmz1 extended permit tcp x.x.129.0 255.255.255.0 host 172.25.144.5 eq smtp
    access-list acl_dmz1 extended permit tcp x.x.129.0 255.255.255.0 host 172.25.145.5 eq smtp
    access-list acl_dmz1 extended deny tcp any any eq smtp
    access-list acl_dmz1 extended permit ip any any
    access-list acl_dmz1 extended permit udp host x.x.157.12 any eq tftp
    access-list acl_dmz1 extended permit tcp host x.x.157.12 any eq ftp
    access-list acl_dmz1 extended permit tcp host x.x.157.12 any eq ftp-data
    access-list acl_dmz1 extended permit ip any host x.x.24.62
    access-list acl_dmz1 extended permit ip any 172.24.54.0 255.255.255.0
    access-list acl_dmz1 extended permit ip any 172.24.21.0 255.255.255.0
    access-list acl_dmz1 extended permit ip any 172.16.68.0 255.255.255.0
    access-list acl_dmz1 extended permit ip host x.x.250.52 host 172.24.23.150
    access-list acl_dmz1 extended permit icmp x.x.75.0 255.255.255.0 any echo
    access-list acl_dmz1 extended permit icmp x.x.75.0 255.255.255.0 any echo-reply
    access-list acl_dmz1 extended permit ip host x.x.75.90 host x.z.186.69
    access-list acl_dmz1 extended permit ip 172.16.51.0 255.255.255.0 host 10.38.65.12
    access-list acl_ServProv extended deny tcp any any eq 5000
    access-list acl_ServProv extended deny tcp any any eq 465
    access-list acl_ServProv extended permit tcp host x.x.159.56 172.24.130.0 255.255.254.0 eq 1044
    access-list acl_ServProv extended permit tcp host x.x.159.56 172.24.132.0 255.255.254.0 eq 1044
    access-list acl_ServProv extended permit tcp host x.x.159.56 172.24.130.0 255.255.254.0 eq 5690
    access-list acl_ServProv extended permit tcp host x.x.159.56 172.24.132.0 255.255.254.0 eq 5690
    access-list acl_in extended permit ip 172.24.20.0 255.255.255.0 any
    access-list acl_in extended permit ip 172.24.17.0 255.255.255.0 any
    access-list acl_in extended permit ip 172.24.172.0 255.255.255.0 any
    access-list acl_in extended permit ip 172.24.28.0 255.255.255.0 any
    access-list acl_in extended permit ip 172.24.35.0 255.255.255.0 x.x.200.0 255.255.255.0
    access-list acl_in extended permit ip 172.24.35.0 255.255.255.0 172.16.53.0 255.255.255.0
    access-list acl_in extended permit ip 172.24.73.0 255.255.255.0 any
    access-list acl_in extended permit ip host x.y.32.10 any
    access-list acl_in extended permit ip host 172.24.114.91 any
    access-list acl_in extended permit tcp any host x.x.159.54 eq https
    access-list acl_in extended permit tcp any host x.x.159.54 eq www
    access-list acl_in extended permit udp any host x.x.159.54 eq 1935
    access-list acl_in extended permit tcp any host x.x.159.54 eq 1935
    access-list acl_in extended permit tcp any host x.x.159.50 eq 1434
    access-list acl_in extended permit udp any host x.x.159.50 eq 1434
    access-list acl_in extended permit udp 172.24.142.0 255.255.255.0 host x.x.159.55 eq 1434
    access-list acl_in extended permit udp 172.24.142.0 255.255.255.0 host x.x.159.53 eq 1434
    access-list acl_in extended permit udp 172.24.142.0 255.255.255.0 host x.x.159.52 eq 1434
    access-list acl_in extended permit udp 172.24.142.0 255.255.255.0 host x.x.159.51 eq 1434
    access-list acl_in extended permit tcp any host x.x.157.110 eq 1434
    access-list acl_in extended permit udp any host x.x.157.110 eq 1434
    access-list acl_in extended deny ip host 172.24.75.50 any
    access-list acl_in extended deny ip host 172.24.21.51 any
    access-list acl_in extended deny ip host 172.24.21.53 any
    access-list acl_in extended deny ip host x.w.80.218 any
    access-list acl_in extended deny ip host x.w.176.4 any
    access-list acl_in extended deny ip host x.w.40.54 any
    access-list acl_in extended deny ip host x.w.47.151 any
    access-list acl_in extended deny udp any any eq tftp
    access-list acl_in extended deny tcp any any eq 6346
    access-list acl_in extended deny tcp any any eq 6699
    access-list acl_in extended deny udp any any eq 1434
    access-list acl_in extended deny ip any host x.x.128.9
    access-list acl_in extended deny tcp any any eq 8998
    access-list acl_in extended deny udp any any eq 8998
    access-list acl_in extended deny tcp any any eq 17300
    access-list acl_in extended deny udp any any eq 17300
    access-list acl_in extended deny tcp any any eq 27374
    access-list acl_in extended deny udp any any eq 27374
    access-list acl_in extended deny udp any any eq 3127
    access-list acl_in extended deny tcp any any eq 5000
    access-list acl_in extended deny tcp any any eq 3410
    access-list acl_in extended permit tcp x.x.0.0 255.255.0.0 any eq 1025
    access-list acl_in extended deny tcp any any range 6881 6999
    access-list acl_in extended permit tcp host x.w.66.68 any eq 1025
    access-list acl_in extended deny tcp any any eq 1025
    access-list acl_in extended permit ip any any
    access-list acl_in extended permit tcp any host x.x.250.39 eq 5222
    access-list acl_in extended permit ip any 172.24.54.0 255.255.255.0
    access-list acl_in extended permit ip any 172.24.21.0 255.255.255.0
    access-list acl_in extended permit ip any 172.16.68.0 255.255.255.0
    access-list acl_in extended permit tcp 172.24.142.0 255.255.255.0 host x.x.159.51 eq 8002
    access-list acl_in extended permit ip host x.x.250.18 172.24.21.0 255.255.255.0
    pager lines 24
    logging enable
    logging timestamp
    logging buffered warnings
    logging trap warnings
    logging history errors
    logging asdm errors
    logging from-address [email protected]
    logging recipient-address [email protected] level emergencies
    logging facility 23
    logging queue 2056
    logging host inside 172.24.20.73
    mtu outside 1500
    mtu inside 1500
    mtu dmz1 1500
    mtu ServProv 1500
    mtu management 1500
    ip verify reverse-path interface outside
    ip verify reverse-path interface inside
    ip verify reverse-path interface dmz1
    ip verify reverse-path interface ServProv
    ip audit name Out-attack attack action drop reset
    ip audit name In-attack attack action drop reset
    ip audit name dmz-attack attack action drop reset
    ip audit name ServProv-attack attack action drop reset
    ip audit interface outside Out-attack
    ip audit interface inside In-attack
    ip audit interface dmz1 dmz-attack
    ip audit interface ServProv ServProv-attack
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-621.bin
    no asdm history enable
    arp timeout 14400
    nat-control
    global (outside) 1 x.x.230.1-x.x.230.254
    global (outside) 1 x.x.231.1-x.x.231.254
    global (outside) 2 x.x.243.1-x.x.243.254
    global (outside) 3 x.x.241.1-x.x.241.20
    global (dmz1) 1 x.x.242.1-x.x.242.254
    global (ServProv) 2 x.x.244.1-x.x.244.254
    nat (inside) 1 0.0.0.0 0.0.0.0 tcp 22000 0
    nat (dmz1) 1 0.0.0.0 0.0.0.0 tcp 28000 0
    nat (ServProv) 2 0.0.0.0 0.0.0.0 tcp 500 0
    static (dmz1,outside) x.x.0.0 x.x.0.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.147.12 x.x.147.12 netmask 255.255.255.255
    static (dmz1,outside) x.x.147.13 x.x.147.13 netmask 255.255.255.255
    static (dmz1,outside) x.x.147.52 x.x.147.52 netmask 255.255.255.255
    static (dmz1,outside) x.x.147.53 x.x.147.53 netmask 255.255.255.255
    static (dmz1,outside) x.x.147.54 x.x.147.54 netmask 255.255.255.255
    static (dmz1,outside) x.x.147.55 x.x.147.55 netmask 255.255.255.255
    static (dmz1,outside) x.x.147.101 x.x.147.101 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.20 x.x.250.20 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.21 x.x.250.21 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.23 x.x.250.23 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.25 x.x.250.25 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.26 x.x.250.26 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.27 x.x.250.27 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.30 x.x.250.30 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.42 x.x.250.42 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.48 x.x.250.48 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.49 x.x.250.49 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.54 x.x.250.54 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.59 x.x.250.59 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.67 x.x.250.67 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.77 x.x.250.77 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.120 x.x.250.120 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.211 x.x.250.211 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.212 x.x.250.212 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.5 x.x.250.5 netmask 255.255.255.255
    static (dmz1,outside) x.w.66.10 x.w.66.10 netmask 255.255.255.255
    static (dmz1,outside) x.w.66.20 x.w.66.20 netmask 255.255.255.255
    static (dmz1,outside) x.w.66.30 x.w.66.30 netmask 255.255.255.255
    static (dmz1,outside) x.w.66.31 x.w.66.31 netmask 255.255.255.255
    static (dmz1,outside) x.w.66.50 x.w.66.50 netmask 255.255.255.255
    static (dmz1,outside) x.w.66.60 x.w.66.60 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.105 x.x.75.105 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.11 x.x.75.11 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.107 x.x.75.107 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.109 x.x.75.109 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.110 x.x.75.110 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.112 x.x.75.112 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.114 x.x.75.114 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.12 x.x.75.12 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.13 x.x.75.13 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.14 x.x.75.14 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.15 x.x.75.15 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.16 x.x.75.16 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.17 x.x.75.17 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.18 x.x.75.18 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.29 x.x.75.29 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.30 x.x.75.30 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.19 x.x.75.19 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.20 x.x.75.20 netmask 255.255.255.255
    static (dmz1,outside) x.x.73.50 x.x.73.50 netmask 255.255.255.255
    static (dmz1,outside) x.x.73.51 x.x.73.51 netmask 255.255.255.255
    static (inside,dmz1) x.y.0.0 x.y.0.0 netmask 255.255.0.0
    static (inside,dmz1) 198.170.2.0 198.170.2.0 netmask 255.255.255.0
    static (inside,dmz1) x.x.30.0 x.x.30.0 netmask 255.255.255.0
    static (inside,dmz1) 192.216.80.0 192.216.80.0 netmask 255.255.255.0
    <--- More --->
    static (inside,dmz1) x.x.146.0 x.x.146.0 netmask 255.255.255.0
    static (inside,dmz1) x.x.224.0 x.x.224.0 netmask 255.255.255.0
    static (inside,dmz1) x.x.44.0 x.x.44.0 netmask 255.255.255.0
    static (inside,dmz1) x.x.86.0 x.x.86.0 netmask 255.255.255.0
    static (inside,dmz1) x.x.145.0 x.x.145.0 netmask 255.255.255.0
    static (inside,dmz1) x.x.130.0 x.x.130.0 netmask 255.255.255.0
    static (inside,dmz1) 198.170.1.0 198.170.1.0 netmask 255.255.255.0
    static (inside,dmz1) x.w.40.0 x.w.40.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.73.55 x.x.73.55 netmask 255.255.255.255
    static (dmz1,outside) x.x.112.2 x.x.112.2 netmask 255.255.255.255
    static (dmz1,outside) x.x.112.3 x.x.112.3 netmask 255.255.255.255
    static (dmz1,outside) x.x.112.7 x.x.112.7 netmask 255.255.255.255
    static (dmz1,outside) x.x.112.21 x.x.112.21 netmask 255.255.255.255
    static (dmz1,outside) x.x.112.30 x.x.112.30 netmask 255.255.255.255
    static (dmz1,outside) x.x.112.35 x.x.112.35 netmask 255.255.255.255
    static (dmz1,outside) x.x.112.36 x.x.112.36 netmask 255.255.255.255
    static (dmz1,outside) x.x.112.50 x.x.112.50 netmask 255.255.255.255
    static (dmz1,outside) x.x.10.100 x.x.10.100 netmask 255.255.255.255
    static (inside,dmz1) x.x.36.0 x.x.36.0 netmask 255.255.255.0
    static (inside,dmz1) x.w.162.0 x.w.162.0 netmask 255.255.255.0
    static (inside,dmz1) x.w.152.0 x.w.152.0 netmask 255.255.255.0
    static (inside,dmz1) x.w.16.0 x.w.16.0 netmask 255.255.255.0
    static (inside,dmz1) x.w.223.0 x.w.223.0 netmask 255.255.255.0
    static (inside,dmz1) x.w.232.0 x.w.232.0 netmask 255.255.255.0
    static (inside,dmz1) x.w.240.0 x.w.240.0 netmask 255.255.255.0
    static (inside,dmz1) x.w.200.0 x.w.200.0 netmask 255.255.255.0
    static (inside,dmz1) x.w.138.0 x.w.138.0 netmask 255.255.255.0
    static (inside,dmz1) x.w.80.0 x.w.80.0 netmask 255.255.255.0
    static (inside,dmz1) x.w.204.0 x.w.204.0 netmask 255.255.255.0
    static (inside,dmz1) x.w.136.0 x.w.136.0 netmask 255.255.255.0
    static (inside,dmz1) x.w.48.0 x.w.48.0 netmask 255.255.255.0
    static (inside,dmz1) x.w.28.0 x.w.28.0 netmask 255.255.255.0
    static (inside,dmz1) x.w.72.0 x.w.72.0 netmask 255.255.255.0
    static (inside,dmz1) x.w.104.0 x.w.104.0 netmask 255.255.255.0
    static (inside,dmz1) x.w.112.0 x.w.112.0 netmask 255.255.255.0
    static (inside,dmz1) x.w.132.0 x.w.132.0 netmask 255.255.255.0
    static (inside,dmz1) x.w.144.0 x.w.144.0 netmask 255.255.255.0
    static (inside,dmz1) x.w.146.0 x.w.146.0 netmask 255.255.255.0
    static (inside,dmz1) x.w.47.0 x.w.47.0 netmask 255.255.255.0
    static (inside,dmz1) x.w.176.0 x.w.176.0 netmask 255.255.255.0
    static (inside,dmz1) x.w.116.0 x.w.116.0 netmask 255.255.255.0
    static (inside,dmz1) 172.25.0.0 172.25.0.0 netmask 255.255.0.0
    static (inside,ServProv) 172.24.112.0 172.24.112.0 netmask 255.255.255.0
    static (inside,ServProv) 172.24.113.0 172.24.113.0 netmask 255.255.255.0
    static (inside,dmz1) 172.24.21.0 172.24.21.0 netmask 255.255.255.0
    static (inside,ServProv) 172.24.21.0 172.24.21.0 netmask 255.255.255.0
    static (inside,dmz1) 172.24.20.0 172.24.20.0 netmask 255.255.255.0
    static (inside,dmz1) 172.24.32.0 172.24.32.0 netmask 255.255.224.0
    static (inside,dmz1) 172.24.96.0 172.24.96.0 netmask 255.255.224.0
    static (inside,ServProv) 172.24.232.0 172.24.232.0 netmask 255.255.255.0
    static (inside,dmz1) 172.24.128.0 172.24.128.0 netmask 255.255.224.0
    static (inside,dmz1) 172.24.160.0 172.24.160.0 netmask 255.255.224.0
    static (inside,dmz1) 172.24.192.0 172.24.192.0 netmask 255.255.224.0
    static (inside,dmz1) 172.24.224.0 172.24.224.0 netmask 255.255.224.0
    static (inside,dmz1) 172.24.64.0 172.24.64.0 netmask 255.255.224.0
    static (inside,dmz1) 172.24.25.0 172.24.25.0 netmask 255.255.255.0
    static (inside,ServProv) 172.24.233.0 172.24.233.0 netmask 255.255.255.0
    static (inside,ServProv) 172.24.20.0 172.24.20.0 netmask 255.255.255.0
    static (inside,dmz1) 172.24.18.0 172.24.18.0 netmask 255.255.255.0
    static (ServProv,dmz1) x.x.149.0 x.x.149.0 netmask 255.255.255.0
    static (inside,dmz1) 10.0.0.0 10.0.0.0 netmask 255.0.0.0
    static (dmz1,outside) x.x.147.51 x.x.147.51 netmask 255.255.255.255
    static (inside,ServProv) 147.76.0.0 147.76.0.0 netmask 255.255.0.0
    static (dmz1,outside) x.w.66.51 x.w.66.51 netmask 255.255.255.255
    static (dmz1,outside) x.x.73.40 x.x.73.40 netmask 255.255.255.255
    static (dmz1,outside) x.x.73.30 x.x.73.30 netmask 255.255.255.255
    static (inside,dmz1) x.x.94.0 x.x.94.0 netmask 255.255.255.0
    static (inside,dmz1) x.w.105.0 x.w.105.0 netmask 255.255.255.0
    static (inside,dmz1) x.w.120.0 x.w.120.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.147.240 x.x.147.60 netmask 255.255.255.255
    static (dmz1,outside) x.w.106.50 x.w.106.50 netmask 255.255.255.255
    static (ServProv,dmz1) x.x.13.1 x.x.13.1 netmask 255.255.255.255
    static (dmz1,outside) x.x.147.66 x.x.147.66 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.105 x.x.250.105 netmask 255.255.255.255
    static (inside,dmz1) x.x.35.0 x.x.35.0 netmask 255.255.255.0
    static (inside,dmz1) x.w.125.0 x.w.125.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.73.57 x.x.73.57 netmask 255.255.255.255
    static (dmz1,outside) x.x.147.81 x.x.147.81 netmask 255.255.255.255
    static (dmz1,outside) x.x.147.91 x.x.147.91 netmask 255.255.255.255
    static (inside,dmz1) 157.123.160.0 157.123.160.0 netmask 255.255.252.0
    static (inside,dmz1) 157.123.96.0 157.123.96.0 netmask 255.255.240.0
    static (inside,dmz1) 157.123.136.0 157.123.136.0 netmask 255.255.252.0
    static (inside,dmz1) 157.123.121.0 157.123.121.0 netmask 255.255.255.0
    static (dmz1,outside) x.w.66.13 x.w.66.13 netmask 255.255.255.255
    static (dmz1,outside) x.w.66.14 x.w.66.14 netmask 255.255.255.255
    static (dmz1,outside) x.w.66.15 x.w.66.15 netmask 255.255.255.255
    static (inside,dmz1) 172.24.6.0 172.24.6.0 netmask 255.255.255.0
    static (inside,dmz1) 172.24.8.0 172.24.8.0 netmask 255.255.255.0
    static (inside,dmz1) 172.24.4.0 172.24.4.0 netmask 255.255.255.0
    static (inside,dmz1) 172.24.153.0 172.24.153.0 netmask 255.255.255.0
    static (inside,dmz1) x.x.37.0 x.x.37.0 netmask 255.255.255.0
    static (inside,dmz1) x.w.161.0 x.w.161.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.250.200 x.x.250.200 netmask 255.255.255.255
    static (dmz1,outside) x.x.147.57 x.x.147.57 netmask 255.255.255.255
    static (dmz1,outside) x.x.147.56 x.x.147.56 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.71 x.x.250.71 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.254 x.x.75.254 netmask 255.255.255.255
    static (dmz1,outside) x.x.13.100 x.x.13.100 netmask 255.255.255.255
    static (dmz1,outside) x.x.73.200 x.x.73.200 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.250 x.x.75.250 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.251 x.x.75.251 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.252 x.x.75.252 netmask 255.255.255.255
    static (inside,dmz1) 172.24.17.100 172.24.17.100 netmask 255.255.255.255
    static (inside,dmz1) 172.24.17.110 172.24.17.110 netmask 255.255.255.255
    static (inside,dmz1) 203.127.246.0 203.127.246.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.92.0 x.x.92.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.250.221 x.x.250.221 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.222 x.x.250.222 netmask 255.255.255.255
    static (inside,dmz1) 1x.15.200.0 1x.15.200.0 netmask 255.255.255.0
    static (inside,dmz1) 1x.15.108.0 1x.15.108.0 netmask 255.255.255.0
    static (inside,dmz1) 1x.191.172.0 1x.191.172.0 netmask 255.255.252.0
    static (inside,dmz1) 172.28.4.0 172.28.4.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.75.35 x.x.75.35 netmask 255.255.255.255
    static (inside,dmz1) 172.24.17.200 172.24.17.200 netmask 255.255.255.255
    static (dmz1,outside) x.x.5.140 x.x.5.140 netmask 255.255.255.255
    static (dmz1,outside) x.w.66.41 x.w.66.41 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.103 x.x.250.103 netmask 255.255.255.255
    static (inside,dmz1) 172.24.17.51 172.24.17.51 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.121 x.x.75.121 netmask 255.255.255.255
    static (dmz1,outside) x.x.147.83 x.x.147.83 netmask 255.255.255.255
    static (inside,dmz1) x.x.1.250 x.x.1.250 netmask 255.255.255.255
    static (dmz1,outside) x.x.147.15 x.x.147.15 netmask 255.255.255.255
    static (inside,dmz1) 1x.15.110.1 1x.15.110.1 netmask 255.255.255.255
    static (ServProv,dmz1) x.x.120.0 x.x.120.0 netmask 255.255.255.0
    static (ServProv,dmz1) x.x.10.0 x.x.10.0 netmask 255.255.255.0
    static (inside,ServProv) 172.24.17.0 172.24.17.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.176.17 x.x.176.17 netmask 255.255.255.255
    static (dmz1,outside) x.x.176.15 x.x.176.15 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.113 x.x.250.113 netmask 255.255.255.255
    static (ServProv,dmz1) x.x.154.0 x.x.154.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.250.56 x.x.250.56 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.61 x.x.250.61 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.60 x.x.250.60 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.58 x.x.250.58 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.57 x.x.250.57 netmask 255.255.255.255
    static (inside,dmz1) 172.28.203.1 172.28.203.1 netmask 255.255.255.255
    static (inside,dmz1) 172.28.203.2 172.28.203.2 netmask 255.255.255.255
    static (inside,dmz1) 172.28.203.3 172.28.203.3 netmask 255.255.255.255
    static (inside,dmz1) 172.28.203.4 172.28.203.4 netmask 255.255.255.255
    static (dmz1,outside) x.x.95.20 x.x.95.20 netmask 255.255.255.255
    static (dmz1,outside) x.x.95.21 x.x.95.21 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.191 x.x.250.191 netmask 255.255.255.255
    static (inside,dmz1) 172.24.27.31 172.24.27.31 netmask 255.255.255.255
    static (inside,dmz1) 172.24.27.19 172.24.27.19 netmask 255.255.255.255
    static (inside,dmz1) 172.24.27.20 172.24.27.20 netmask 255.255.255.255
    static (inside,dmz1) 172.24.27.22 172.24.27.22 netmask 255.255.255.255
    static (inside,dmz1) 172.24.27.64 172.24.27.64 netmask 255.255.255.192
    static (inside,dmz1) 172.24.27.128 172.24.27.128 netmask 255.255.255.128
    static (inside,dmz1) 172.24.27.30 172.24.27.30 netmask 255.255.255.255
    static (inside,dmz1) 172.24.27.15 172.24.27.15 netmask 255.255.255.255
    static (inside,dmz1) 172.24.27.11 172.24.27.11 netmask 255.255.255.255
    static (inside,dmz1) 172.24.27.10 172.24.27.10 netmask 255.255.255.255
    static (inside,dmz1) 172.24.17.21 172.24.17.21 netmask 255.255.255.255
    static (inside,dmz1) 192.168.106.0 192.168.106.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.250.69 x.x.250.69 netmask 255.255.255.255
    static (inside,dmz1) 172.24.17.30 172.24.17.30 netmask 255.255.255.255
    static (inside,dmz1) 128.191.160.0 128.191.160.0 netmask 255.255.252.0
    static (inside,dmz1) 128.191.140.0 128.191.140.0 netmask 255.255.252.0
    static (inside,dmz1) 172.24.27.32 172.24.27.32 netmask 255.255.255.224
    static (dmz1,outside) x.x.147.58 x.x.147.58 netmask 255.255.255.255
    static (inside,dmz1) 172.24.27.254 172.24.27.254 netmask 255.255.255.255
    static (inside,ServProv) 172.24.27.254 172.24.27.254 netmask 255.255.255.255
    static (dmz1,outside) x.x.147.84 x.x.147.84 netmask 255.255.255.255
    static (dmz1,outside) x.x.176.76 x.x.176.76 netmask 255.255.255.255
    static (ServProv,outside) x.x.120.144 x.x.120.144 netmask 255.255.255.240
    static (ServProv,outside) x.x.120.160 x.x.120.160 netmask 255.255.255.240
    static (ServProv,outside) x.x.120.192 x.x.120.192 netmask 255.255.255.224
    static (ServProv,outside) x.x.120.224 x.x.120.224 netmask 255.255.255.240
    static (ServProv,outside) x.x.120.252 x.x.120.252 netmask 255.255.255.255
    static (inside,ServProv) 172.24.27.10 172.24.27.10 netmask 255.255.255.255
    static (inside,dmz1) 203.127.254.7 203.127.254.7 netmask 255.255.255.255
    static (dmz1,outside) x.x.112.5 x.x.112.5 netmask 255.255.255.255
    static (dmz1,outside) x.x.112.4 x.x.112.4 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.122 x.x.75.122 netmask 255.255.255.255
    static (inside,ServProv) 172.24.114.0 172.24.114.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.75.25 x.x.75.25 netmask 255.255.255.255
    static (inside,dmz1) 172.24.27.13 172.24.27.13 netmask 255.255.255.255
    static (ServProv,outside) x.x.120.0 x.x.120.0 netmask 255.255.255.128
    static (inside,dmz1) 172.24.27.0 172.24.27.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.250.100 x.x.250.100 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.197 x.x.250.197 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.193 x.x.250.193 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.196 x.x.250.196 netmask 255.255.255.255
    static (dmz1,outside) x.w.66.53 x.w.66.53 netmask 255.255.255.255
    static (inside,dmz1) x.x.82.0 x.x.82.0 netmask 255.255.255.0
    static (inside,dmz1) x.w.222.0 x.w.222.0 netmask 255.255.255.0
    static (inside,ServProv) 172.24.27.11 172.24.27.11 netmask 255.255.255.255
    static (inside,dmz1) 192.168.100.0 192.168.100.0 netmask 255.255.255.0
    static (inside,dmz1) 192.168.101.0 192.168.101.0 netmask 255.255.255.0
    static (inside,dmz1) x.x.99.0 x.x.99.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.229.67 x.x.147.67 netmask 255.255.255.255
    static (dmz1,outside) x.x.10.196 x.x.10.196 netmask 255.255.255.255
    static (inside,dmz1) x.w.102.0 x.w.102.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.75.115 x.x.75.115 netmask 255.255.255.255
    static (ServProv,outside) x.x.10.196 x.x.10.196 netmask 255.255.255.255
    static (inside,dmz1) 1x.1x.137.0 1x.1x.137.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.250.11 x.x.250.11 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.47 x.x.75.47 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.42 x.x.75.42 netmask 255.255.255.255
    static (inside,ServProv) 172.24.27.20 172.24.27.20 netmask 255.255.255.255
    static (inside,dmz1) 172.24.22.0 172.24.22.0 netmask 255.255.255.0
    static (inside,ServProv) 172.24.22.0 172.24.22.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.75.50 x.x.75.50 netmask 255.255.255.255
    static (inside,ServProv) 172.24.172.0 172.24.172.0 netmask 255.255.255.0
    static (inside,ServProv) x.x.35.0 x.x.35.0 netmask 255.255.255.0
    static (inside,ServProv) 172.24.160.0 172.24.160.0 netmask 255.255.255.0
    static (inside,ServProv) 172.24.215.0 172.24.215.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.176.45 x.x.176.45 netmask 255.255.255.255
    static (inside,ServProv) 172.24.25.0 172.24.25.0 netmask 255.255.255.0
    static (ServProv,dmz1) x.x.13.10 x.x.13.10 netmask 255.255.255.255
    static (ServProv,dmz1) x.x.13.20 x.x.13.20 netmask 255.255.255.255
    static (ServProv,dmz1) x.x.164.0 x.x.164.0 netmask 255.255.255.0
    static (inside,ServProv) 172.24.142.0 172.24.142.0 netmask 255.255.255.0
    static (inside,ServProv) 172.24.72.0 172.24.72.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.250.202 x.x.250.202 netmask 255.255.255.255
    static (dmz1,outside) x.x.112.112 x.x.112.112 netmask 255.255.255.255
    static (inside,ServProv) 172.24.54.0 172.24.54.0 netmask 255.255.255.0
    static (inside,ServProv) 172.24.161.0 172.24.161.0 netmask 255.255.255.0
    static (dmz1,outside) x.w.66.100 x.w.66.100 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.150 x.x.75.150 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.152 x.x.75.152 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.153 x.x.75.153 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.154 x.x.75.154 netmask 255.255.255.255
    static (inside,dmz1) 172.24.28.0 172.24.28.0 netmask 255.255.255.0
    static (inside,dmz1) 172.26.144.0 172.26.144.0 netmask 255.255.240.0
    static (inside,dmz1) 172.26.160.0 172.26.160.0 netmask 255.255.240.0
    static (dmz1,outside) x.x.75.140 x.x.75.140 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.141 x.x.75.141 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.142 x.x.75.142 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.180 x.x.250.180 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.115 x.x.250.115 netmask 255.255.255.255
    static (ServProv,outside) x.x.119.0 x.x.119.0 netmask 255.255.255.224
    static (ServProv,dmz1) x.x.119.0 x.x.119.0 netmask 255.255.255.224
    static (inside,ServProv) 172.24.134.0 172.24.134.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.250.190 x.x.250.190 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.95 x.x.250.95 netmask 255.255.255.255
    static (inside,dmz1) 172.24.23.0 172.24.23.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.250.82 x.x.250.82 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.83 x.x.250.83 netmask 255.255.255.255
    static (inside,dmz1) 172.24.17.40 172.24.17.40 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.84 x.x.250.84 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.85 x.x.250.85 netmask 255.255.255.255
    static (inside,dmz1) 172.24.24.0 172.24.24.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.250.90 x.x.250.90 netmask 255.255.255.255
    static (inside,ServProv) 172.25.74.0 172.25.74.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.250.80 x.x.250.80 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.81 x.x.250.81 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.93 x.x.250.93 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.65 x.x.250.65 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.101 x.x.250.101 netmask 255.255.255.255
    static (ServProv,dmz1) x.x.156.0 x.x.156.0 netmask 255.255.255.0
    static (inside,ServProv) 172.24.150.0 172.24.150.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.250.140 x.x.250.140 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.141 x.x.250.141 netmask 255.255.255.255
    static (dmz1,outside) x.x.69.15 x.x.69.15 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.156 x.x.75.156 netmask 255.255.255.255
    static (inside,ServProv) 172.24.24.0 172.24.24.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.75.157 x.x.75.157 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.86 x.x.250.86 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.87 x.x.250.87 netmask 255.255.255.255
    static (inside,dmz1) 147.76.204.58 147.76.204.58 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.161 x.x.75.161 netmask 255.255.255.255
    static (inside,dmz1) 172.24.17.41 172.24.17.41 netmask 255.255.255.255
    static (inside,dmz1) 172.24.17.31 172.24.17.31 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.32 x.x.75.32 netmask 255.255.255.255
    static (inside,ServProv) 172.26.168.0 172.26.168.0 netmask 255.255.254.0
    static (dmz1,outside) x.x.75.60 x.x.75.60 netmask 255.255.255.255
    static (inside,dmz1) 172.24.75.0 172.24.75.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.75.158 x.x.75.158 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.192 x.x.250.192 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.80 x.x.75.80 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.45 x.x.250.45 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.23 x.x.75.23 netmask 255.255.255.255
    static (dmz1,outside) x.x.73.59 x.x.73.59 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.66 x.x.250.66 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.46 x.x.75.46 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.45 x.x.75.45 netmask 255.255.255.255
    static (inside,dmz1) 172.28.32.230 172.28.32.230 netmask 255.255.255.255
    static (dmz1,outside) x.x.251.15 x.x.251.15 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.158 x.x.250.158 netmask 255.255.255.255
    static (inside,dmz1) 172.24.29.0 172.24.29.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.73.61 x.x.73.61 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.70 x.x.75.70 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.203 x.x.250.203 netmask 255.255.255.255
    static (inside,dmz1) 1x.1x.169.6 1x.1x.169.6 netmask 255.255.255.255
    static (inside,dmz1) 1x.1x.169.16 1x.1x.169.16 netmask 255.255.255.255
    static (inside,dmz1) 1x.1x.169.9 1x.1x.169.9 netmask 255.255.255.255
    static (inside,dmz1) 172.31.8.115 172.31.8.115 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.81 x.x.75.81 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.99 x.x.250.99 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.117 x.x.75.117 netmask 255.255.255.255
    static (dmz1,outside) x.x.176.198 x.x.176.198 netmask 255.255.255.254
    static (inside,ServProv) x.y.32.0 x.y.32.0 netmask 255.255.255.0
    static (inside,ServProv) 172.24.130.0 172.24.130.0 netmask 255.255.255.0
    static (inside,ServProv) 172.24.133.0 172.24.133.0 netmask 255.255.255.0
    static (inside,dmz1) 172.24.30.0 172.24.30.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.75.74 x.x.75.74 netmask 255.255.255.255
    static (inside,dmz1) 172.24.112.81 172.24.112.81 netmask 255.255.255.255
    static (ServProv,outside) x.x.159.162 x.x.159.162 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.22 x.x.250.22 netmask 255.255.255.255
    static (ServProv,outside) x.x.159.250 x.x.159.250 netmask 255.255.255.255
    static (inside,dmz1) 1xx.1xx.170.143 1xx.1xx.170.143 netmask 255.255.255.255
    static (inside,ServProv) 172.25.249.0 172.25.249.0 netmask 255.255.255.0
    static (inside,ServProv) 172.24.23.0 172.24.23.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.75.113 x.x.75.113 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.50 x.x.250.50 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.171 x.x.75.171 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.172 x.x.75.172 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.175 x.x.75.175 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.177 x.x.75.177 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.179 x.x.75.179 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.180 x.x.75.180 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.181 x.x.75.181 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.182 x.x.75.182 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.183 x.x.75.183 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.184 x.x.75.184 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.143 x.x.75.143 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.21 x.x.75.21 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.110 x.x.250.110 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.185 x.x.75.185 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.174 x.x.75.174 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.176 x.x.75.176 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.178 x.x.75.178 netmask 255.255.255.255
    static (ServProv,outside) x.x.120.205 x.x.120.205 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.44 x.x.250.44 netmask 255.255.255.255
    static (inside,dmz1) 172.27.133.0 172.27.133.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.75.186 x.x.75.186 netmask 255.255.255.255
    static (inside,ServProv) 1x.1x.172.0 1x.1x.172.0 netmask 255.255.252.0
    static (inside,ServProv) 172.25.248.0 172.25.248.0 netmask 255.255.255.0
    static (inside,dmz1) 172.24.17.90 172.24.17.90 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.187 x.x.75.187 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.163 x.x.75.163 netmask 255.255.255.255
    static (inside,ServProv) 172.31.20.0 172.31.20.0 netmask 255.255.255.0
    static (inside,ServProv) 172.31.30.0 172.31.30.0 netmask 255.255.255.0
    static (inside,ServProv) 172.24.28.0 172.24.28.0 netmask 255.255.255.0
    static (ServProv,outside) x.x.157.60 x.x.157.60 netmask 255.255.255.255
    static (ServProv,outside) x.x.157.130 x.x.157.130 netmask 255.255.255.255
    static (inside,ServProv) 172.24.132.0 172.24.132.0 netmask 255.255.255.0
    static (ServProv,dmz1) x.x.157.0 x.x.157.0 netmask 255.255.255.0
    static (inside,ServProv) 172.24.154.0 172.24.154.0 netmask 255.255.255.0
    static (inside,ServProv) 172.24.193.0 172.24.193.0 netmask 255.255.255.0
    static (inside,ServProv) 172.26.168.0 172.26.168.0 netmask 255.255.255.0
    static (inside,ServProv) 172.26.169.0 172.26.169.0 netmask 255.255.255.0
    static (inside,ServProv) 172.24.76.0 172.24.76.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.75.54 x.x.75.54 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.55 x.x.75.55 netmask 255.255.255.255
    static (dmz1,outside) x.x.0.20 x.x.0.20 netmask 255.255.255.255 tcp 10000 100
    static (inside,ServProv) 128.191.168.0 128.191.168.0 netmask 255.255.252.0
    static (inside,dmz1) x.x.80.0 x.x.80.0 netmask 255.255.255.0
    static (inside,dmz1) 172.25.2.0 172.25.2.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.80.10 x.x.80.10 netmask 255.255.255.255
    static (inside,ServProv) x.x.152.0 x.x.152.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.0.21 x.x.0.21 netmask 255.255.255.255 tcp 10000 100
    static (inside,ServProv) 172.31.43.0 172.31.43.0 netmask 255.255.255.0
    static (inside,dmz1) 172.24.76.0 172.24.76.0 netmask 255.255.255.0
    static (inside,dmz1) 172.24.77.0 172.24.77.0 netmask 255.255.255.0
    static (inside,dmz1) 1x.1x.168.0 1x.1x.168.0 netmask 255.255.252.0
    static (inside,dmz1) 1x.1x.169.0 1x.1x.169.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.75.33 x.x.75.33 netmask 255.255.255.255
    static (ServProv,outside) x.x.152.110 x.x.152.110 netmask 255.255.255.255
    static (dmz1,outside) x.w.66.61 x.w.66.61 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.188 x.x.75.188 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.57 x.x.75.57 netmask 255.255.255.255
    static (inside,ServProv) 172.24.73.0 172.24.73.0 netmask 255.255.255.0
    static (ServProv,outside) x.x.120.161 x.x.120.161 netmask 255.255.255.255
    static (inside,dmz1) 172.24.17.60 172.24.17.60 netmask 255.255.255.255
    static (inside,dmz1) 172.24.17.61 172.24.17.61 netmask 255.255.255.255
    static (inside,dmz1) 172.27.129.0 172.27.129.0 netmask 255.255.255.0
    static (inside,dmz1) 172.27.132.0 172.27.132.0 netmask 255.255.255.0
    static (ServProv,outside) x.x.157.40 x.x.157.40 netmask 255.255.255.255
    static (ServProv,outside) x.x.157.152 x.x.157.152 netmask 255.255.255.255
    static (ServProv,outside) x.x.159.150 x.x.159.150 netmask 255.255.255.255
    static (ServProv,outside) x.x.159.151 x.x.159.151 netmask 255.255.255.255
    static (ServProv,outside) x.x.157.41 x.x.157.41 netmask 255.255.255.255
    static (inside,ServProv) 172.24.144.0 172.24.144.0 netmask 255.255.255.0
    static (inside,ServProv) 172.25.108.0 172.25.108.0 netmask 255.255.252.0
    static (inside,ServProv) 172.25.181.0 172.25.181.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.176.196 x.x.176.196 netmask 255.255.255.255
    static (dmz1,outside) x.x.176.197 x.x.176.197 netmask 255.255.255.255
    static (dmz1,outside) x.w.66.70 x.w.66.70 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.111 x.x.75.111 netmask 255.255.255.255
    static (inside,ServProv) 172.26.175.0 172.26.175.0 netmask 255.255.255.0
    static (inside,dmz1) 172.16.80.0 172.16.80.0 netmask 255.255.255.0
    static (inside,ServProv) 172.26.165.0 172.26.165.0 netmask 255.255.255.0
    <--- More --->
    static (inside,dmz1) 172.27.137.0 172.27.137.0 netmask 255.255.255.0
    static (inside,dmz1) 172.27.136.0 172.27.136.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.75.145 x.x.75.145 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.146 x.x.75.146 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.31 x.x.250.31 netmask 255.255.255.255
    static (dmz1,outside) x.w.66.64 x.w.66.64 netmask 255.255.255.255
    static (dmz1,outside) x.w.66.65 x.w.66.65 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.144 x.x.75.144 netmask 255.255.255.255
    static (ServProv,outside) x.x.165.12 x.x.165.12 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.147 x.x.75.147 netmask 255.255.255.255
    static (dmz1,outside) x.x.90.91 x.x.90.91 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.156 x.x.250.156 netmask 255.255.255.255
    static (ServProv,dmz1) x.x.165.0 x.x.165.0 netmask 255.255.255.0
    static (ServProv,outside) x.x.159.52 x.x.159.52 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.190 x.x.75.190 netmask 255.255.255.255
    static (inside,ServProv) 172.24.224.0 172.24.224.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.75.138 x.x.75.138 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.35 x.x.250.35 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.191 x.x.75.191 netmask 255.255.255.255
    static (inside,ServProv) 172.26.160.0 172.26.160.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.75.162 x.x.75.162 netmask 255.255.255.255
    static (dmz1,outside) x.w.66.59 x.w.66.59 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.166 x.x.75.166 netmask 255.255.255.255
    static (dmz1,outside) x.w.66.80 x.w.66.80 netmask 255.255.255.255
    static (dmz1,outside) x.w.66.81 x.w.66.81 netmask 255.255.255.255
    static (dmz1,outside) x.w.66.82 x.w.66.82 netmask 255.255.255.255
    static (inside,dmz1) 172.24.14.0 172.24.14.0 netmask 255.255.255.0
    static (inside,dmz1) 172.24.13.0 172.24.13.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.73.63 x.x.73.63 netmask 255.255.255.255
    static (ServProv,outside) x.x.159.53 x.x.159.53 netmask 255.255.255.255
    static (inside,dmz1) 1x.x.111.0 1x.x.111.0 netmask 255.255.255.0
    static (inside,ServProv) 172.16.22.0 172.16.22.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.250.225 x.x.250.225 netmask 255.255.255.255
    static (dmz1,outside) x.x.73.70 x.x.73.70 netmask 255.255.255.255
    static (dmz1,outside) x.x.85.12 x.x.85.12 netmask 255.255.255.255
    static (dmz1,outside) x.x.148.10 x.x.148.10 netmask 255.255.255.255
    static (inside,dmz1) x.x.118.0 x.x.118.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.168.0 x.x.168.0 netmask 255.255.255.192
    static (ServProv,outside) x.x.159.51 x.x.159.51 netmask 255.255.255.255
    static (inside,dmz1) 172.16.16.0 172.16.16.0 netmask 255.255.248.0
    static (inside,dmz1) 172.27.135.0 172.27.135.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.250.112 x.x.250.112 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.109 x.x.250.109 netmask 255.255.255.255
    static (ServProv,outside) x.x.159.200 x.x.159.200 netmask 255.255.255.255
    static (ServProv,outside) x.x.159.201 x.x.159.201 netmask 255.255.255.255
    static (ServProv,outside) x.x.159.202 x.x.159.202 netmask 255.255.255.255
    static (ServProv,outside) x.x.159.203 x.x.159.203 netmask 255.255.255.255
    static (ServProv,outside) x.x.159.204 x.x.159.204 netmask 255.255.255.255
    static (ServProv,outside) x.x.159.205 x.x.159.205 netmask 255.255.255.255
    static (ServProv,outside) x.x.159.206 x.x.159.206 netmask 255.255.255.255
    static (ServProv,outside) x.x.159.207 x.x.159.207 netmask 255.255.255.255
    static (ServProv,outside) x.x.159.208 x.x.159.208 netmask 255.255.255.255
    static (ServProv,outside) x.x.159.209 x.x.159.209 netmask 255.255.255.255
    static (ServProv,outside) x.x.159.210 x.x.159.210 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.36 x.x.250.36 netmask 255.255.255.255
    static (dmz1,outside) x.x.73.75 x.x.73.75 netmask 255.255.255.255
    static (dmz1,outside) x.w.66.58 x.w.66.58 netmask 255.255.255.255
    static (dmz1,outside) x.x.73.76 x.x.73.76 netmask 255.255.255.255
    static (ServProv,outside) x.x.120.216 x.x.120.216 netmask 255.255.255.255
    static (dmz1,outside) x.w.66.57 x.w.66.57 netmask 255.255.255.255
    static (inside,ServProv) 172.24.166.0 172.24.166.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.75.167 x.x.75.167 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.168 x.x.75.168 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.169 x.x.75.169 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.134 x.x.75.134 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.135 x.x.75.135 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.136 x.x.75.136 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.137 x.x.75.137 netmask 255.255.255.255
    static (dmz1,outside) x.x.85.20 x.x.85.20 netmask 255.255.255.255
    static (dmz1,outside) x.w.66.56 x.w.66.56 netmask 255.255.255.255
    static (dmz1,outside) x.x.147.47 x.x.147.47 netmask 255.255.255.255
    static (dmz1,outside) x.x.73.71 x.x.73.71 netmask 255.255.255.255
    static (inside,dmz1) 172.24.17.120 172.24.17.120 netmask 255.255.255.255
    static (inside,dmz1) 172.24.17.125 172.24.17.125 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.16 x.x.250.16 netmask 255.255.255.255
    static (inside,ServProv) 172.16.18.0 172.16.18.0 netmask 255.255.255.0
    static (inside,ServProv) 128.191.124.0 128.191.124.0 netmask 255.255.252.0
    static (dmz1,outside) x.x.75.173 x.x.75.173 netmask 255.255.255.255
    static (ServProv,outside) x.x.159.54 x.x.159.54 netmask 255.255.255.255
    static (ServProv,outside) x.x.159.55 x.x.159.55 netmask 255.255.255.255
    static (dmz1,outside) x.w.66.69 x.w.66.69 netmask 255.255.255.255
    static (inside,ServProv) 172.24.141.0 172.24.141.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.147.110 x.x.147.110 netmask 255.255.255.255
    static (dmz1,outside) x.x.147.112 x.x.147.112 netmask 255.255.255.255
    static (dmz1,outside) x.x.147.111 x.x.147.111 netmask 255.255.255.255
    static (dmz1,outside) x.x.147.113 x.x.147.113 netmask 255.255.255.255
    static (dmz1,outside) x.x.147.114 x.x.147.114 netmask 255.255.255.255
    static (dmz1,outside) x.x.147.115 x.x.147.115 netmask 255.255.255.255
    static (dmz1,outside) x.x.147.116 x.x.147.116 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.72 x.x.250.72 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.76 x.x.250.76 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.73 x.x.250.73 netmask 255.255.255.255
    static (inside,ServProv) 172.24.40.0 172.24.40.0 netmask 255.255.255.0
    static (inside,ServProv) 172.24.41.0 172.24.41.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.250.74 x.x.250.74 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.75 x.x.250.75 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.78 x.x.250.78 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.79 x.x.250.79 netmask 255.255.255.255
    static (dmz1,outside) x.w.66.68 x.w.66.68 netmask 255.255.255.255
    static (inside,ServProv) 172.24.74.0 172.24.74.0 netmask 255.255.255.0
    static (ServProv,dmz1) x.x.159.0 x.x.159.0 netmask 255.255.255.0
    static (inside,ServProv) 172.26.172.0 172.26.172.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.75.200 x.x.75.200 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.189 x.x.75.189 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.121 x.x.250.121 netmask 255.255.255.255
    static (dmz1,outside) x.x.200.11 x.x.200.11 netmask 255.255.255.255
    static (dmz1,outside) x.x.200.12 x.x.200.12 netmask 255.255.255.255
    static (dmz1,outside) x.x.200.13 x.x.200.13 netmask 255.255.255.255
    static (dmz1,outside) x.x.200.14 x.x.200.14 netmask 255.255.255.255
    static (dmz1,outside) x.x.200.15 x.x.200.15 netmask 255.255.255.255
    static (dmz1,outside) x.x.200.16 x.x.200.16 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.56 x.x.75.56 netmask 255.255.255.255
    static (inside,dmz1) 172.24.35.0 172.24.35.0 netmask 255.255.255.0
    static (ServProv,outside) x.x.165.100 x.x.165.100 netmask 255.255.255.255
    static (inside,dmz1) 172.26.176.0 172.26.176.0 netmask 255.255.255.0
    static (inside,ServProv) 10.47.73.201 10.47.73.201 netmask 255.255.255.255
    static (ServProv,outside) x.x.157.151 x.x.157.151 netmask 255.255.255.255
    static (ServProv,outside) x.x.157.150 x.x.157.150 netmask 255.255.255.255
    static (ServProv,outside) x.x.159.50 x.x.159.50 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.58 x.x.75.58 netmask 255.255.255.255
    static (ServProv,outside) x.x.120.218 x.x.120.218 netmask 255.255.255.255
    static (ServProv,outside) x.x.157.46 x.x.157.46 netmask 255.255.255.255
    static (dmz1,outside) x.x.200.17 x.x.200.17 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.106 x.x.75.106 netmask 255.255.255.255
    static (inside,ServProv) 172.24.75.0 172.24.75.0 netmask 255.255.255.0
    static (inside,ServProv) 172.24.77.0 172.24.77.0 netmask 255.255.255.0
    static (inside,ServProv) 172.24.78.0 172.24.78.0 netmask 255.255.255.0
    static (ServProv,outside) x.x.157.11 x.x.157.11 netmask 255.255.255.255
    static (inside,ServProv) 172.24.192.0 172.24.192.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.250.46 x.x.250.46 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.47 x.x.250.47 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.33 x.x.250.33 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.34 x.x.250.34 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.37 x.x.250.37 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.38 x.x.250.38 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.59 x.x.75.59 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.104 x.x.75.104 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.51 x.x.250.51 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.152 x.x.250.152 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.151 x.x.250.151 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.39 x.x.250.39 netmask 255.255.255.255
    static (dmz1,outside) x.x.157.12 x.x.157.12 netmask 255.255.255.255
    static (ServProv,outside) x.x.159.56 x.x.159.56 netmask 255.255.255.255
    static (ServProv,outside) x.x.159.57 x.x.159.57 netmask 255.255.255.255
    static (ServProv,outside) x.x.159.58 x.x.159.58 netmask 255.255.255.255
    static (ServProv,outside) x.x.159.59 x.x.159.59 netmask 255.255.255.255
    static (inside,ServProv) 172.24.169.0 172.24.169.0 netmask 255.255.255.0
    static (inside,ServProv) 172.16.68.0 172.16.68.0 netmask 255.255.255.0
    static (inside,ServProv) 172.24.156.0 172.24.156.0 netmask 255.255.255.0
    static (ServProv,outside) x.x.157.224 x.x.157.224 netmask 255.255.255.255
    static (ServProv,outside) x.x.159.60 x.x.159.60 netmask 255.255.255.255
    static (ServProv,outside) x.x.159.61 x.x.159.61 netmask 255.255.255.255
    static (ServProv,outside) x.x.157.100 x.x.157.100 netmask 255.255.255.255
    static (dmz1,outside) x.x.105.246 x.x.105.246 netmask 255.255.255.255
    static (dmz1,outside) x.x.24.62 x.x.24.62 netmask 255.255.255.255
    static (ServProv,outside) x.x.157.9 x.x.157.9 netmask 255.255.255.255
    static (inside,ServProv) 172.26.149.0 172.26.149.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.200.20 x.x.200.20 netmask 255.255.255.255
    static (dmz1,outside) x.x.200.21 x.x.200.21 netmask 255.255.255.255
    static (dmz1,outside) x.x.200.22 x.x.200.22 netmask 255.255.255.255
    static (ServProv,outside) x.x.159.120 x.x.159.120 netmask 255.255.255.255
    static (ServProv,outside) x.x.159.121 x.x.159.121 netmask 255.255.255.255
    static (ServProv,outside) x.x.159.122 x.x.159.122 netmask 255.255.255.255
    static (ServProv,outside) x.x.159.123 x.x.159.123 netmask 255.255.255.255
    static (ServProv,outside) x.x.159.124 x.x.159.124 netmask 255.255.255.255
    static (ServProv,outside) x.x.159.125 x.x.159.125 netmask 255.255.255.255
    static (ServProv,outside) x.x.159.126 x.x.159.126 netmask 255.255.255.255
    static (dmz1,inside) x.x.250.39 x.x.250.39 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.40 x.x.250.40 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.53 x.x.250.53 netmask 255.255.255.255
    static (ServProv,outside) x.x.157.49 x.x.157.49 netmask 255.255.255.255
    static (ServProv,outside) x.x.157.50 x.x.157.50 netmask 255.255.255.255
    static (ServProv,outside) x.x.157.85 x.x.157.85 netmask 255.255.255.255
    static (ServProv,outside) x.x.157.245 x.x.157.245 netmask 255.255.255.255
    static (ServProv,outside) x.x.157.240 x.x.157.240 netmask 255.255.255.255
    static (ServProv,outside) x.x.157.241 x.x.157.241 netmask 255.255.255.255
    static (ServProv,outside) x.x.157.242 x.x.157.242 netmask 255.255.255.255
    static (ServProv,outside) x.x.157.243 x.x.157.243 netmask 255.255.255.255
    static (inside,ServProv) 172.24.71.0 172.24.71.0 netmask 255.255.255.0
    static (ServProv,outside) x.x.157.238 x.x.157.238 netmask 255.255.255.255
    static (ServProv,outside) x.x.157.239 x.x.157.239 netmask 255.255.255.255
    static (ServProv,inside) x.x.159.51 x.x.159.51 netmask 255.255.255.255
    static (inside,ServProv) 172.24.181.0 172.24.181.0 netmask 255.255.255.0
    static (inside,ServProv) 172.24.131.0 172.24.131.0 netmask 255.255.255.0
    static (inside,dmz1) 172.16.68.0 172.16.68.0 netmask 255.255.255.0
    static (inside,ServProv) 172.24.35.0 172.24.35.0 netmask 255.255.255.0
    static (ServProv,inside) x.x.159.54 x.x.159.54 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.102 x.x.250.102 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.18 x.x.250.18 netmask 255.255.255.255
    static (ServProv,outside) x.x.157.127 x.x.157.127 netmask 255.255.255.255
    static (dmz1,outside) x.x.55.0 x.x.55.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.56.0 x.x.56.0 netmask 255.255.255.0
    static (ServProv,outside) x.x.157.51 x.x.157.51 netmask 255.255.255.255
    static (ServProv,outside) x.x.157.52 x.x.157.52 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.48 x.x.75.48 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.55 x.x.250.55 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.90 x.x.75.90 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.70 x.x.250.70 netmask 255.255.255.255
    static (dmz1,inside) 172.16.51.0 172.16.51.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.75.192 x.x.75.192 netmask 255.255.255.255
    static (inside,ServProv) 172.26.158.0 172.26.158.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.250.122 x.x.250.122 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.193 x.x.75.193 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.131 x.x.250.131 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.132 x.x.250.132 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.195 x.x.75.195 netmask 255.255.255.255
    static (dmz1,outside) x.x.75.194 x.x.75.194 netmask 255.255.255.255
    static (inside,dmz1) 172.26.143.0 172.26.143.0 netmask 255.255.255.0
    static (ServProv,inside) x.x.159.56 x.x.159.56 netmask 255.255.255.255
    static (ServProv,inside) x.x.159.55 x.x.159.55 netmask 255.255.255.255
    static (inside,ServProv) x.y.34.0 x.y.34.0 netmask 255.255.255.0
    static (inside,ServProv) 172.27.132.0 172.27.132.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.75.91 x.x.75.91 netmask 255.255.255.255
    static (inside,dmz1) 172.24.164.0 172.24.164.0 netmask 255.255.254.0
    static (inside,ServProv) 172.24.164.0 172.24.164.0 netmask 255.255.254.0
    static (dmz1,outside) x.x.250.210 x.x.250.210 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.62 x.x.250.62 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.63 x.x.250.63 netmask 255.255.255.255
    static (dmz1,outside) x.x.250.68 x.x.250.68 netmask 255.255.255.255
    static (dmz1,inside) x.x.75.91 x.x.75.91 netmask 255.255.255.255
    static (dmz1,inside) x.x.75.90 x.x.75.90 netmask 255.255.255.255
    static (inside,dmz1) 172.24.73.0 172.24.73.0 netmask 255.255.255.0
    static (dmz1,outside) x.x.73.91 x.x.73.91 netmask 255.255.255.255
    access-group acl_out in interface outside
    access-group acl_in in interface inside
    access-group acl_dmz1 in interface dmz1
    access-group acl_ServProv in interface ServProv
    route outside 0.0.0.0 0.0.0.0 x.x.6.1 1
    route inside 10.0.0.0 255.0.0.0 172.25.1.1 1
    route dmz1 10.52.109.125 255.255.255.255 x.x.0.1 1
    route dmz1 10.207.0.0 255.255.0.0 x.x.0.1 1
    route dmz1 10.222.0.0 255.255.255.0 x.x.0.1 1
    route dmz1 x.x.179.160 255.255.255.224 x.x.0.1 1
    route dmz1 x.x.54.0 255.255.255.0 x.x.0.1 1
    route dmz1 x.x.3.25 255.255.255.255 x.x.0.1 1
    route dmz1 x.x.48.76 255.255.255.255 x.x.0.1 1
    route dmz1 x.x.237.0 255.255.255.0 x.x.0.1 1
    route inside 1x.1x.0.0 255.255.0.0 172.25.1.1 1
    route outside 1x.1x.16.0 255.255.252.0 x.x.6.1 1
    route dmz1 1x.1x.128.0 255.255

  • Static NAT and same IP address for two interfaces

    We have a Cisco ASA 5520 and in order to conserve public IP addresses and configuration (possibly) can we use the same public IP address for a static NAT with two different interfaces? Here is an example of what I'm refering too where 10.10.10.10 would be the same public IP address.
    static (inside,Outside) 10.10.10.10  access-list inside_nat_static_1
    static (production,Outside) 10.10.10.10  access-list production_nat_static_1
    Thanks for any help.
    Jeff

    Hi Jeff,
    Unfortunately this cannot be done, on the ASA packet classification is done on the basis of mac-address, destination nat and route, and here you are confusing the firewall, to which interface does the ip belong to. I haven't ever tried to do it, but it should cause you issues.
    Thanks,
    Varun Rao
    Security Team,
    Cisco TAC

  • Problems getting static NAT to work between two internal lans

    Hi, I'm trying the old problem of routing between two internal LANs. This on cli 8.6(1)2. I have three interfaces/LANs; outside is to the internet, inside is the rack in the datacentre and office is a dedicated ethernet link to our office. What I want to do is allow all (for now) traffic betrween office and inside. There's a million hits on this on the 'net but I can't get it to work. Packet trace shows packets accepted from office to inside but blocked from inside to office. Both static nats are set up identically. Here's the output of show nat after packet traces in both directions. It clearly shows that inside to office isn't hitting the nat policy. I enclose what I think are the relevant bits of my config. Full config less passwords + crypto attached.
    Manual NAT Policies (Section 1)
    1 (office) to (inside) source static inside-office inside-office   destination static inside-ld5 inside-ld5 no-proxy-arp route-lookup
        translate_hits = 0, untranslate_hits = 3
    2 (inside) to (office) source static inside-ld5 inside-ld5   destination static inside-office inside-office no-proxy-arp route-lookup
        translate_hits = 0, untranslate_hits = 0
    interface GigabitEthernet0/0
    nameif inside-ld5
    security-level 100
    ip address 10.20.15.2 255.255.255.0
    interface GigabitEthernet0/6
    nameif office
    security-level 100
    ip address 10.20.11.9 255.255.255.0
    object network inside-ld5
    subnet 10.20.15.0 255.255.255.0
    object network inside-office
    subnet 10.20.11.0 255.255.255.0
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    nat (office,inside) source static inside-office inside-office destination static inside-ld5 inside-ld5 no-proxy-arp route-lookup
    nat (inside,office) source static inside-ld5 inside-ld5 destination static inside-office inside-office no-proxy-arp route-lookup

    Hi Kevin,
    because your interfaces inside and office are in same security level and you have enabled same-security-traffic permit inter-interface, traffic should simply flow between this interfaces. So i think you don't need NAT between this two subnets if there is not other reason to do so.
    Then you just configure ACL which will permit traffic you want between this LANs. In this case both netwroks are directly conneted so routing should work(instead of NAT).
    Best Regards,
    Jan

  • Static NAT inbound correct - Outbound using Interface IP

    Here is the scenario that i have:
    I have a router (2921) that has 2 interfaces:
         G0/0 - WAN - 10.254.1.10
         G0/1 - LAN - 192.168.1.230
    I have a few static NATs for servers that are behind g0/1, this is the only nat config i have except for an 'ip nat inside' and 'ip nat outside' on the interfaces:
         ip nat inside source static 192.168.1.231 10.254.1.11
         ip nat inside source static 192.168.1.232 10.254.1.12
         ip nat inside source static 192.168.1.240 10.254.1.13
    I can connect to each of these on their respective NAT'd IP.
    The issue that i have is when these servers go out they have the interface IP address!  So if i ping a server that is across the way i see
    SRC: 10.254.1.10 DST: 10.1.2.11 Protocol: ICMP
    I do not understand how this would work??  i have no other NAT configuration in the router.

    Here is the NAT table when pinging from the outside to one of the NAT'd servers:
    Pinging from 10.1.2.11 to 10.254.1.13
    Cisco2921#sh ip nat trans
    Pro Inside global      Inside local       Outside local      Outside global
    --- 10.254.1.11        192.168.1.231      ---                ---
    tcp 10.254.1.12:80     192.168.1.232:80   10.1.2.11:62512    10.1.2.11:62512
    tcp 10.254.1.12:443    192.168.1.232:443  10.1.2.11:62491    10.1.2.11:62491
    tcp 10.254.1.12:443    192.168.1.232:443  10.1.2.11:62493    10.1.2.11:62493
    --- 10.254.1.12        192.168.1.232      ---                ---
    icmp 10.254.1.13:1     192.168.1.240:1    10.1.2.11:1        10.1.2.11:1
    tcp 10.254.1.13:22     192.168.1.240:22   10.1.2.11:62386    10.1.2.11:62386
    tcp 10.254.1.13:80     192.168.1.240:80   10.1.2.11:62508    10.1.2.11:62508
    tcp 10.254.1.13:80     192.168.1.240:80   10.1.2.11:62510    10.1.2.11:62510
    tcp 10.254.1.13:80     192.168.1.240:80   10.1.2.11:62511    10.1.2.11:62511
    icmp 10.254.1.10:21531 192.168.1.240:21531 10.1.2.11:21531   10.1.2.11:21531
    udp 10.254.1.10:38288  192.168.1.240:38288 10.1.2.1:161      10.1.2.1:161
    udp 10.254.1.10:55051  192.168.1.240:55051 10.1.2.1:161      10.1.2.1:161
    udp 10.254.1.10:55383  192.168.1.240:55383 10.1.2.1:161      10.1.2.1:161
    udp 10.254.1.10:58944  192.168.1.240:58944 10.1.2.1:161      10.1.2.1:161
    udp 10.254.1.10:59854  192.168.1.240:59854 10.1.2.1:161      10.1.2.1:161
    --- 10.254.1.13        192.168.1.240      ---                ---
    Here is from an internal server to the same outside host:
    Pinging from 192.168.1.240 to 10.1.2.11
    Cisco2921#sh ip nat trans
    Pro Inside global      Inside local       Outside local      Outside global
    --- 10.254.1.11        192.168.1.231      ---                ---
    tcp 10.254.1.12:80     192.168.1.232:80   10.1.2.11:62517    10.1.2.11:62517
    tcp 10.254.1.12:443    192.168.1.232:443  10.1.2.11:62491    10.1.2.11:62491
    tcp 10.254.1.12:443    192.168.1.232:443  10.1.2.11:62493    10.1.2.11:62493
    --- 10.254.1.12        192.168.1.232      ---                ---
    tcp 10.254.1.13:22     192.168.1.240:22   10.1.2.11:62386    10.1.2.11:62386
    tcp 10.254.1.13:80     192.168.1.240:80   10.1.2.11:62515    10.1.2.11:62515
    tcp 10.254.1.13:80     192.168.1.240:80   10.1.2.11:62516    10.1.2.11:62516
    tcp 10.254.1.13:80     192.168.1.240:80   10.1.2.11:62518    10.1.2.11:62518
    icmp 10.254.1.10:7163  192.168.1.240:7163 10.1.2.1:7163      10.1.2.1:7163
    icmp 10.254.1.10:7184  192.168.1.240:7184 10.1.2.1:7184      10.1.2.1:7184
    icmp 10.254.1.10:11548 192.168.1.240:11548 10.1.2.11:11548   10.1.2.11:11548
    udp 10.254.1.10:38288  192.168.1.240:38288 10.1.2.1:161      10.1.2.1:161
    udp 10.254.1.10:53384  192.168.1.240:53384 10.1.2.1:161      10.1.2.1:161
    udp 10.254.1.10:58383  192.168.1.240:58383 10.1.2.1:161      10.1.2.1:161
    udp 10.254.1.10:58944  192.168.1.240:58944 10.1.2.1:161      10.1.2.1:161
    udp 10.254.1.10:59143  192.168.1.240:59143 10.1.2.1:161      10.1.2.1:161
    --- 10.254.1.13        192.168.1.240      ---                ---

  • Static NAT entry disappears when using NVI on Cisco 1921 (Multiple versions)

    We have a Cisco 1921 as an IPSec tunnel endpoint where we assign static NAT entries. It is a static one-to-one NAT putting each remote endpoint as a local /24 subnet. We are using NVI and we see some of these static entries disappear when packets are unable to reach the destination. 
    The production router is running 15.0(1r)M16 but we were able to reproduce this same behavior on 15.4(1)T2.
    To reproduce, we add the static NVI entry:
    ip nat source static X.X.X.X 172.30.250.11
    And things look good for a bit:
    ROUTER# sh ip nat nvi trans | i 172.30.250.11
    gre 172.30.250.11:0 X.X.X>X:0 Y.Y.Y.Y:0 Y.Y.Y.Y:0
    --- 172.30.250.11 138.54.32.9 --- ---
    tcp Y.Y.Y.Y:60360 Z.Z.Z.Z:60360 172.30.250.11:22 X.X.X.X:22
    There is a known issue with GRE traffic being dropped at this particular endpoint, so after generating GRE traffic, the entry completely disappears:
    ROUTER# sh run | i 172.30.250.11
    ROUTER#
    ROUTER# sh ip nat nvi trans | i 172.30.250.11
    gre 172.30.250.11:0 X.X.X>X:0 Y.Y.Y.Y:0 Y.Y.Y.Y:0
    icmp Y.Y.Y.Y:59916 Z.Z.Z.Z:59916 172.30.250.11:59916 172.30.250.11:59916
    tcp Y.Y.Y.Y:60360 Z.Z.Z.Z:60360 172.30.250.11:22 X.X.X.X:22
    I can reproduce this by severing the tunnel to any other remote site, and after generating GRE traffic to the downed endpoint, the corresponding static NAT entry will disappear.
    Debugging has not shown anything, and I have found some mentions of similar behavior on older versions. Has anyone seen this? We don't have support access to test all versions, so if it is known to be resolved in a particular one, we would love to know to work towards loading that version.
    Thanks

    Hi Ryan,
    Asa cannot ahve 2 default routes, it can only have one. ASA also doesnt support PBR, so the setup that you are trying to configure would not work on the ASA. Router is the correct option for it.
    Hope that helps.
    Thanks,
    Varun Rao
    Security Team,
    Cisco TAC

Maybe you are looking for

  • Cannot log into Vimeo

    Keep trying to log into my Vimeo account on my 3rd gen Apple TV and keep getting this: Sign In Failed 401 Unauthorized - User Not Found - The user credentials passed are not valid I am perfectly able to sign in and browse Vimeo on both Safari on my i

  • JTA transaction unexpectedly rolled back

    I have a Spring Java web app deployed on OC4J 10.1.3.3 using Toplink as the container managed persistence. When my app is launched a named query is executed that uses JPQL to load up collections of objects. It is failing with the subject line excepti

  • Creating a project with 5.1 audio channels

    Hi, My camera can record in 5.1 channels (I have a multi channel mic for that). If I record using it, I obviously want to create a project that can include this and that will eventually will get me to create a DVD with 5.1 channels, so I can benefit

  • CS5.5 installation from disc, error(20), Windows 8.1

    I am trying to install CS 5.5 from the installation disc on my new laptop (running Windows 8.1) but I keep getting the following error message: "The Setup encountered an error(20) during install. Please restart the machine and try again." Restarting

  • HELP!!!! -- Error allocating a servlet instance

    Please help me... The deathline for my schoolproject is getting close!!! - 2 weeks ago everything worked fine - now i wanted to start at making the last changes... but...the only thing a get is this... HTTP Status 500 - type Exception report message