Cisco ASA Dynamic NAT with DMZ

[ReneMolenaar]

Hello Heng,

Have you tried packet-tracer on the ASA? That should give you a reason why the ASA drops it.

Cisco ASA Access-List

Hi Asi, Here’s a good document from Cisco that explains the “order of operation” for the ASA: Cisco ASA Packet Flow The packet tracer tool on the ASA is also great to answer this question. For example: ASA# packet-tracer input INSIDE tcp 192.168.1.1 50001 1.2.3.4 80 This will show us the packet flow for a host that is using IP address 192.168.1.1 and who wants to connect to TCP port 80 on 1.2.3.4. Here’s the result: Phase: 1 Type: ACCESS-LIST Subtype: Result: ALLOW Config: Implicit Rule A…

Rene