345 reputation
319
bio website ushr.com
location Cambridge, MA | Montreal | Capbreton France
age
visits member for 4 years, 2 months
seen Jun 22 at 8:35

Psychologist turned programmer, developing on the JVM with the Typesafe stack (Akka, Play, and Slick) server-side, and Coffeescript + GruntJS client-side.

Currently hacking on the U.S. Hockey Report, an amateur hockey scouting news service.

For contracting gigs email: admin '@' newmindit.com


Aug
7
comment ESXi :: Management Console on Private IP over VPN
Hmmm, I do have another server on the network that could provide NTP data. I assume this means that ESXi itself does not need access to outside world other than for keeping accurate time via NTP? Are most people putting console on a public IP? I'd prefer to keep it private, VPN is great for locking down servers to minimal exposure.
Aug
7
asked ESXi :: Management Console on Private IP over VPN
Aug
6
comment ASA VPN :: Why Blocked Packets on Private Network?
Evan, route add did the trick, but only after I changed inside vlan to a 10.1.1.1 range -- most home modem/routers use 192.168.x.x and that seems to have been conflicting with VPN network which was on the same subnet. Now, I can lock down my servers and actually make use of the VPN ;--) Thanks!!
Aug
6
awarded  Scholar
Aug
6
accepted ASA VPN :: Why Blocked Packets on Private Network?
Aug
6
comment ASA VPN :: Why Blocked Packets on Private Network?
it's lengthy, if you want to dig through it, sure I can post...
Aug
5
comment ASA VPN :: Why Blocked Packets on Private Network?
I will give this a shot, Evan, Cisco SMARTnet support suggested the same. Of course, now Cisco VPN client on OSX can't even ping on vlan inside interface 192.168.0.1, while VPN client in Windows VM can ping it just fine, groan, lol. Going to reboot OSX and then try out the route suggestion in Linux boxes behind the ASA Thanks!
Aug
5
asked ASA VPN :: Why Blocked Packets on Private Network?
Jul
28
awarded  Commentator
Jul
28
comment ASA 5505 :: Routed/NAT or Transparent mode for inside Web/DNS Server
awesome, just need to know the originating outside IP. Maybe DC engineer is saying that NAT with static IP ranges is not going to work (since I'm looking to break my /27 up into a few different block ranges, 1 to backup server, and 4 to production ESXi server with 2X dual port NICs). Could also be the switch between the ASA and servers, don't know, none of this seems terribly complex, pretty basic setup...
Jul
27
comment ASA 5505 :: Routed/NAT or Transparent mode for inside Web/DNS Server
I am going to find out, Jason, will be giving TAC a call, and hopefully set up the ASA in routed mode/NAT without shelling out $120/hr to a DC that seems not to know what they're talking about...
Jul
27
comment ASA 5505 :: Routed/NAT or Transparent mode for inside Web/DNS Server
Dave, good, so to confirm, you are in routed mode and are using NAT? We are running ESXi and have a /27 IP block to work with. Based on replies thus far, routed mode with NAT seems to be the preferred solution, while, by omission, Transparent mode seems to be what you do when NAT solution is not possible. Looks like in NAT internal servers have access to the originating global IP request; if that's the case, I don't see why the DC is saying that NAT will break the inside DNS.
Jul
27
comment ASA 5505 :: Routed/NAT or Transparent mode for inside Web/DNS Server
could be true, hope not given the hefty billing. I think they are saying that in NAT internal servers do not know of the external IP range, just the NAT'd internal IP range.
Jul
27
comment ASA 5505 :: Routed/NAT or Transparent mode for inside Web/DNS Server
agreed Jason, I want to utilize available ASA features and not be restricted. The setup is: uplink >> firewall >> switch >> backup & ESXi server. I would think that even in routed/NAT that inside would know the external IP it is "receiving", and that DNS server would know it has X external IP range available to it. I just bought SMARTnet, data center is not terribly helpful, despite $120/hour "advanced support" fee.
Jul
27
asked ASA 5505 :: Routed/NAT or Transparent mode for inside Web/DNS Server
Jul
25
comment ASA >> Switch >> Server WAN/LAN Routing to NIC ports
thanks setup is: uplink >> firewall >> switch >> 2 servers (ESXi & a backup server) ASA will route /27 IP block through switch to the 2 servers. I know how to set a dual port NIC in bare metal setup (ex. WAN IP to eth0 and LAN IP to eth1), but not to ESXi on 2X dual port NICs where I want ethX to receive BOTH WAN & LAN IP ranges (so I can access ESXi VMs on ethX via WAN or LAN IP) I guess I could dedicate 2 ports to WAN and 2 ports to LAN, but that's not ideal, would much prefer 4 WAN/LAN port groups to use for devel & prod VMs...
Jul
25
asked ASA >> Switch >> Server WAN/LAN Routing to NIC ports
Jul
25
awarded  Supporter
Jul
23
comment ESXi :: ASA NAT + Switch :: Setup on .27 IP Block
Right @MarkM, the switch is behind the firewall, data center engineer must have missed that, obviously the switch does not need a public IP. @Farseeker, thanks for the feedback, coming from a simple bare metal LAMP setup, ESXi is a bit over the top (in a good way); I'm just looking for a sensible way to route external traffic to target VMs and how to allocate this 30 IP block in a way that I don't have to juggle IP ranges in future. I guess it's a common problem, a single subnet, multiple services and servers.
Jul
23
awarded  Student