I have an Access Rule and a NAT rule that works fine with on the Security Appliance Software Version 8.0

The rule is as follows: enter image description here

enter image description here

However, I am having trouble making the same rule work on an ASA running on the Security Appliance Software Version 8.4.

I know that the configuration has changed, I think I am just supposed to create a network object for ath-security and define my access and NAT rules at the same time, but I haven't configured anything on an ASA in years and got a little over my head.

I have it setup as follows:

enter image description here enter image description here

What am I doing wrong here?

The CORP-OUTSIDE and NM-OUTSIDE are supposed to be different; these are two different ASA's. The XXXX-OUTSIDE is a network object for the outside IP address of each device. CORP-OUTSIDE is on the ASA with the 8.0 software, NM-OUTSIDE is on the ASA with the 8.4 software

show running-config returns the following on ASA with 8.0 software:

static (inside,outside) tcp interface www LVMSecurity www netmask

show running-config returns the following on the ASA with the 8.3 software:

object network AthertonSecurity-2.123 nat (inside,outside) static interface service tcp www www

Using the ASDM Packet Trace tool, I get the following error on the 8.3 ASA:

Info: (sp-security-failed) Slowpath security checks failed

  • I see CORP-OUTSIDE in one place and NM-OUTSIDE in the other. That could be it. You also have different services defined - in one place, it's tcp/http and in the other it's tcp, as well as using PAT in one, and not in the other. No offense, but are you a bit over your head with this? – HopelessN00b Dec 30 '14 at 20:26
  • Basically I got put into a job where I was in charge of everything. About 3 years ago I bought some training material, books, videos, etc and learned what I needed to and configured these ASA's on the older software, I haven't done anything with them in years so its like anything - if you don't use it, you forget it. – Jeff Dec 30 '14 at 20:32
  • As a first step, I'd recommend using the Packet Tracer built into the ASDM GUI to see where the communication breaks down, and if you need help after that, editing the information into your post. It would also be a lot easier to diagnose if we could see the relevant config of the devices in question (show running-config), rather than a few screenclips. – HopelessN00b Dec 30 '14 at 20:47
  • I fixed your edits, its not hte 8.0 and 8.4 asdm software it is the ASA OS itself, sorry for the confusion. – Jeff Dec 30 '14 at 20:52
  • I see. Cisco redesigned their NAT rules in versions 8.3, so that's where I'd look for the problem. This document may be of some help, but not being an ASDM guy, I probably won't be of much use with just the screenshots to go on. – HopelessN00b Dec 30 '14 at 20:59

Figured this out, posting what I believe is the answer:

The problem was with the ACL within the Access Rules settings. It seems in the 8.3 software the Destination Criteria, Destination: should no longer be the 'outside interface' but the Network Object destination itself.

It seems Cisco switched the configuration from being what seems backwards, to the correct way?

  • This is documented in Cisco's 8.3 migration document. – James Sneeringer Jan 15 '15 at 14:40
  • I know now, but I never looked at it because I thought I was configuring the network object incorrectly, not the access list rule. – Jeff Jan 15 '15 at 14:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.