Group,
I have a puzzling NAT problem with my ASA and need some help. I have a 4
interface ASA , Outside, Inside, DMZ1, & DMZ2. Going out to Outside I have
2 Lan2Lan VPNS to 2 different site. On DMZ1 the servers all have internet
access via PAT on the outside interface. I want to do the same to DMZ2
servers, but ever time I create the NAT the servers can access the internet,
but users at remote site2 loose connection to the servers. Below is the
config sections, can some one point me in the correct direction? I want
both DMZ servers to PAT to the OUTSIDE interface when they access the
internet. Can some one tell me what I am doing wrong? I am sure it is
something simple that I am blanking on.
interface GigabitEthernet0/0
description TO INTERNET
nameif OUTSIDE
security-level 0
ip address 1.1.1.1 255.255.255.192
interface GigabitEthernet0/1
description TO DMZ1 SERVERS
nameif DMZ1
security-level 10
ip address 10.99.3.1 255.255.255.0
interface GigabitEthernet0/3
description TO INSIDE
nameif INSIDE
security-level 80
ip address 10.173.28.4 255.255.255.0
interface GigabitEthernet1/3
description TO DMZ2 SERVERS
nameif DMZ2
security-level 10
ip address 10.19.152.49 255.255.255.240
global (OUTSIDE) 1 interface
nat (DMZ1) 0 access-list NO-NAT
nat (DMZ1) 1 0.0.0.0 0.0.0.0
nat (DMZ2) 1 0.0.0.0 0.0.0.0
access-list VPNSITE1 extended permit ip object-group DMZ1-NET object-group
VPN-SITE1
access-list VPNSITE2 extended permit ip object-group DMZ2-NET object-group
VPN-SITE2
access-list NO-NAT extended permit ip object-group DMZ1-NET object-group
VPN-SITE1
access-list NO-NAT extended permit ip object-group DMZ2-NET object-group
VPN-SITE2
crypto map VPN-MAP 10 match address VPNSITE1
crypto map VPN-MAP 10 set peer 10.10.164.185
crypto map VPN-MAP 10 set transform-set VPN1SET
crypto map VPN-MAP 11 match address VPNSITE2
crypto map VPN-MAP 11 set peer 10.10.198.202
crypto map VPN-MAP 11 set transform-set VPN2SET
-- Christopher D. Copley copley.chris_at_gmail.com Blogs and organic groups at http://www.ccie.netReceived on Wed Sep 21 2011 - 21:10:55 ART
This archive was generated by hypermail 2.2.0 : Sat Oct 01 2011 - 07:26:25 ART