ColbyG wrote: » the first one
ColbyG wrote: » One is a static route and the other is a PAT statement.
Use the [B]show interface[/B] command to ensure that the security appliance is connected to the network and is passing traffic. The address of the specified [I]if_name[/I] is used as the source address of the ping. If you want internal hosts to ping external hosts, you must do one of the following: •[IMG]http://www.cisco.com/en/US/i/templates/blank.gif[/IMG]Create an ICMP [B]access-list[/B] command for an echo reply; for example, to give ping access to all hosts, use the [B]access-list acl_grp permit icmp any any[/B] command and bind the [B]access-list[/B] command to the interface that you want to test using the [B]access-group[/B] command. •[IMG]http://www.cisco.com/en/US/i/templates/blank.gif[/IMG]Configure the ICMP inspection engine using the [B]inspect icmp[/B] command. For example, adding the [B]inspect icmp[/B] command to the [B]class default_inspection[/B] class for the global service policy allows echo replies through the security appliance for echo requests initiated by internal hosts. You can also perform an extended ping, which allows you to enter the keywords one line at a time. If you are pinging through the security appliance between hosts or routers, but the pings are not successful, use the [COLOR=Black][B]capture [/B][/COLOR]command to monitor the success of the ping. The security appliance [COLOR=Black][B]ping[/B][/COLOR] command does not require an interface name. If you do not specify an interface name, the security appliance checks the routing table to find the address that you specify. You can specify an interface name to indicate through which interface the ICMP echo requests are sent. [B] Examples [/B] The following example shows how to determine if other IP addresses are visible from the security appliance: hostname# [B]ping 171.69.38.1 [/B] Sending 5, 100-byte ICMP Echos to 171.69.38.1, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/10 ms The following example specifies a host using a DNS name: hostname# [B]ping www.example.com [/B] Sending 5, 100-byte ICMP Echos to www.example.com, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/10 ms The following is an example of an extended ping: hostname# ping Interface: outside Target IP address: [B]171.69.38.1 [/B] Repeat count: [5] Datagram size: [100] Timeout in seconds: [2] Extended commands [n]: Sweep range of sizes [n]: Sending 5, 100-byte ICMP Echos to 171.69.38.1, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/10 ms
lon21 wrote: » Guys, My outside interface has two ip address 192.168.0.1 and 0.4. My internal device are given ip address form dhcp from the asa. I want only the 192.168.2.3 device to send all traffic to 192.168.0.4, I've created a specific NAT rule, I've tried to test it via a ping but all traffic is not doing through. Here my ASA lab config... global (outside) 2 192.168.0.4 global (outside) 1 interface nat (inside) 2 192.168.2.3 255.255.255.255 nat (inside) 1 192.168.2.0 255.255.255.0
instant000 wrote: » I just noticed that your translations overlap. (that is, 192.168.2.3/32, falls within 192.168.2.0/24) Can you please adjust this? We get this at work sometimes, and it causes inconsistent traffic issues.(the every-other-packet syndrome) If you set up a debug for your NAT, it might help you to see what's going on. Without a diagram to look at, I'm only guessing, at this point.
lon21 wrote: » How would I configure this? As I want the 2.3 to go out one ip address but all the other host to go out another? When you use static can it do PAT And NAT?
