ASA5505 mehrere Externe IP-Adressen - 1 Interface

[mels]

Hallo Leute!

Ich hab jetzt eine ASA5505 konfiguriert, nur ich schaffe es nicht,
auf das Interface 0/0 Outside mehrere externe IP-Adressen zu binden.

195.1xx.2xx.242
195.1xx.2xx.243
195.1xx.2xx.244
195.1xx.2xx.245
195.1xx.2xx.246

Auf diese IP-Adressen soll die ASA reagieren!

Antwort bekomme ich aber nur bei der .242

Wie hat wer einen Tip für mich?

Derzeitige Konfig:

interface Vlan1
nameif inside
security-level 100
ip address 192.168.30.25 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 195.143.241.242 255.255.255.240
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!


global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
static (outside,inside) 192.168.30.1 195.1xx.2xx.243 netmask 255.255.255.255
static (outside,inside) 192.168.30.2 195.1xx.2xx.244 netmask 255.255.255.255
static (outside,inside) 192.168.30.5 195.1xx.2xx.245 netmask 255.255.255.255
static (outside,inside) 192.168.30.8 195.143.2xx.2xx netmask 255.255.255.255
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 195.1xx.2xx.241 1



Vielen dank im Voraus!

lg
Jörg

[Wordo]

Hast du auch access-lists dazu? Grundsaetzlich unterstuetzt das die ASA ja.
Was siehst du im Log?
Asymtric Nat errors?

[mels]

Hallo!

Danke für Deine Antwort!

Accesslist habe ich, Fehlermeldung kann ich derzeit leider nicht auslesen, da ich den Router zur Zeit nicht im Zugriff habe!

Braucht man hierfür vielleicht wieder eine extra Lizenz oder so?

access-list outside_cryptomap extended permit ip Inside-PC-LAN_0.30 255.255.255.0 M_168.190 255.255.255.0
access-list outside_cryptomap_1 extended permit ip Inside-PC-LAN_0.30 255.255.255.0 Holl_Net_10.0.0. 255.255.255.128
access-list outside_access_in extended permit ip any host 195.1xx.2xx.242
access-list outside_access_in extended permit tcp any host 195.1xx.2xx.242
access-list outside_access_in extended permit tcp any host 195.1xx.2xx.243 eq https
access-list outside_access_in extended permit tcp any host 195.1xx.2xx.243 object-group Semiramis
access-list outside_access_in extended permit tcp any host 195.1xx.2xx.244 eq echo
access-list outside_access_in extended permit tcp any host 195.1xx.2xx.244 eq www
access-list outside_access_in extended permit tcp any host 195.1xx.2xx.244 eq https
access-list outside_access_in extended permit tcp any host 195.1xx.2xx.244 eq lotusnotes
access-list outside_access_in extended permit tcp any host 195.1xx.2xx.244 object-group mSuite
access-list outside_access_in extended permit tcp any host 195.1xx.2xx.244 eq smtp
access-list outside_access_in extended permit tcp any host 195.1xx.2xx.245 eq https
access-list outside_access_in extended permit tcp any host 195.1xx.2xx.245 object-group Semiramis
access-list outside_access_in extended permit tcp any host 195.1xx.2xx.246 eq https
access-list outside_access_in extended permit tcp any host 195.1xx.2xx.246 eq lotusnotes
access-list outside_access_in extended permit tcp any host 195.1xx.2xx.246 eq www
access-list outside_access_in extended permit tcp any host 195.1xx.2xx.246 object-group mSuite
access-list outside_access_in extended permit tcp any host 195.1xx.2xx.246 eq smtp
access-list outside_access_in extended permit ip host 9x.xx.xx.9 host 195.1xx.2xx.242
access-list outside_access_in extended permit ip host 8x.xx.xx.2 host 195.1xx.2xx.242
access-list outside_access_in extended permit ip Inside-PC-LAN_0.30 255.255.255.0 Holl_Net_10.0.0. 255.255.255.128
access-list outside_access_in extended permit ip Inside-PC-LAN_0.30 255.255.255.0 host Holl_SAP_2xx.xx5
access-list inside_access_in extended permit tcp Inside-PC-LAN_0.30 255.255.255.0 host 195.1xx.2xx.244 eq lotusnotes
access-list inside_access_in extended permit ip any any

Vielen dank im Voraus!

lg
Jörg

[Wordo]

Noe, Lizenz passt, aber jetzt kommts noch auf die Version (bis 8.2, oder ab 8.3) und NAT an.

[mels]

Hallo!

Version: ASA Version 8.2(1)


global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
static (outside,inside) 192.168.30.1 195.1xx.2xx.243 netmask 255.255.255.255
static (outside,inside) 192.168.30.2 195.1xx.2xx.244 netmask 255.255.255.255
static (outside,inside) 192.168.30.5 195.1xx.2xx.245 netmask 255.255.255.255
static (outside,inside) 192.168.30.8 195.1xx.2xx.246 netmask 255.255.255.255
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 195.1xx.2xx.241 1

Meinst Du das?

Danke!

lg
Jörg

[Wordo]

Probier mal static (inside,outside)

[mels]

Hallo!

Du meinst

statt
static (outside,inside) 192.168.30.1 195.1xx.2xx.243 netmask 255.255.255.255

jetzt

static (inside,outside) 192.168.30.1 195.1xx.2xx.243 netmask 255.255.255.255

?

Danke

lg
Jörg

[Wordo]

Ja ...

[mels]

Hallo!

Danke für die Hilfe!

Ich hab das jetzt ausprobiert, keine Veränderung!

195.1xx.2xx.241 ist ping bar
195.1xx.2xx.242 ist ping bar

195.1xx.2xx.243 nicht erreichbar
195.1xx.2xx.244 nicht erreichbar
195.1xx.2xx.245 nicht erreichbar
195.1xx.2xx.246 nicht erreichbar

Es ist so als würde die ASA wirklich nur auf die 195.1xx.2xx.242 horcht!

Kann man da noch wo was einstellen?

Vielen dank im Voraus!

lg
Jörg

[Wordo]

Hast du hier irgendwie Ping freigeschaltet?

access-list outside_access_in extended permit tcp any host 195.1xx.2xx.243 eq https
access-list outside_access_in extended permit tcp any host 195.1xx.2xx.243 object-group Semiramis
access-list outside_access_in extended permit tcp any host 195.1xx.2xx.244 eq echo
access-list outside_access_in extended permit tcp any host 195.1xx.2xx.244 eq www
access-list outside_access_in extended permit tcp any host 195.1xx.2xx.244 eq https
access-list outside_access_in extended permit tcp any host 195.1xx.2xx.244 eq lotusnotes
access-list outside_access_in extended permit tcp any host 195.1xx.2xx.244 object-group mSuite
access-list outside_access_in extended permit tcp any host 195.1xx.2xx.244 eq smtp
access-list outside_access_in extended permit tcp any host 195.1xx.2xx.245 eq https
access-list outside_access_in extended permit tcp any host 195.1xx.2xx.245 object-group Semiramis
access-list outside_access_in extended permit tcp any host 195.1xx.2xx.246 eq https
access-list outside_access_in extended permit tcp any host 195.1xx.2xx.246 eq lotusnotes
access-list outside_access_in extended permit tcp any host 195.1xx.2xx.246 eq www
access-list outside_access_in extended permit tcp any host 195.1xx.2xx.246 object-group mSuite
access-list outside_access_in extended permit tcp any host 195.1xx.2xx.246 eq smtp