232 reputation
410
bio website scorch2000.com
location United States
age 35
visits member for 4 years, 9 months
seen Nov 7 at 3:03

Oct
18
awarded  Notable Question
Jul
30
awarded  Notable Question
Feb
25
awarded  Notable Question
Jul
18
awarded  Popular Question
Jun
16
awarded  Popular Question
Jun
3
awarded  Popular Question
Jan
13
awarded  Yearling
Jan
12
answered hp dl380 g4 hardware monitor software
Oct
21
comment Script to run on Gentoo Linux after computer crash
nah, don't worry about it. I said if have jokingly, I dont like the site fragmentation too much, but this one is actually sort of ok to migrate.
Oct
20
comment Script to run on Gentoo Linux after computer crash
migrate to serverfault! migrate to serverfault!
Aug
27
comment cisco asa NAT to site-to-site VPN
@Shane I updated with the new packet-trace. I see the VPN step but it says deny=true... but continues. IKE is already established at that point, the VPN link is always up. If I run telnet y.y.y.y 8080 on the system behind this ASA it works.
Aug
27
revised cisco asa NAT to site-to-site VPN
added 5164 characters in body
Aug
26
comment cisco asa NAT to site-to-site VPN
same-security-traffic helped somewhat -- the packet-tracer now shows that the packet is allowed. However the connection is not established and tcpdump on the VPN peer doesn't see the packets hitting it...
Aug
26
comment cisco asa NAT to site-to-site VPN
@Shane updated with packet-tracer output. It's not matching my allow rules and goes to implicit deny all rule.
Aug
26
revised cisco asa NAT to site-to-site VPN
added 1156 characters in body
Aug
26
comment cisco asa NAT to site-to-site VPN
@Shane that rule does have any in it, that's any for the source address. I think you misread it. I tried changing it to allow to any from any for all tcp and it still didn't work. I don't think it realizes that it should route the packet to VPN, but what can I do about it?
Aug
26
comment cisco asa NAT to site-to-site VPN
@Shan NAT rule hits and says untranslate [outside address]/80 [inside address]/8080 which is correct. Then it says ACCESS-LIST - dropped by an implicit rule. So somehow my outside_access_in is not matching, but how?
Aug
26
revised cisco asa NAT to site-to-site VPN
added 689 characters in body
Aug
26
comment cisco asa NAT to site-to-site VPN
yes, good point, vpn is on outside, so I changed the nat to be outside,outside and now I'm just getting denied by implicit rule. So somehow it's not hitting my ACL. I'll update the question with some of the rules, please take a look.
Aug
26
comment cisco asa NAT to site-to-site VPN
I can't post too much. I don't think NAT is relevant, for example, because I have a bunch of rules that look the same (except address is local, not via vpn) and work.... I was hoping for a hint on direction were to dig -- where is this kind of routing set up?