This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Initial Routing from Internal to External Interfaces Fails?

Hi All,

I am new to Astaro Security Gateway. I am trying to learn the device in a rush. I am currently running an ASG220 v6.203. The device already had the internal network (on eth0) configured. I added a second network called EXTERNAL (on eth1), and a third called DMZ (on eth2).

I activated EXTERNAL and was able to perform UP2DATE updates to bring the device from version 6.200 to 6.203. I can ping from the device to the Internet. I can ping the IP of eth1 from a PC on a switch connected to eth0. What I can't seem to do is get any traffic from the INTERNAL network to the EXTERNAL network.

In otherwords, I can't browse the Internet from my INTERNAL network. According to the manual for the ASG220, static routing for internal interfaces is configured by the software automatically. This seems to have worked.

Am I missing something? Did I set something up wrong? Any help would be greatly appreciated.

Thank you,

Ken

This thread was automatically locked due to age.

0 BarryG over 19 years ago

You need to setup some PacketFilter rules to allow outgoing traffic.
Default is DENY.

Also, you may need to setup NAT/Masq.

This is covered in the manual; also there is a "getting started guide" and other documents at http://www.astaro.com/support/documents_resources

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 kwermann over 19 years ago in reply to BarryG

Hi Barry,

I added a packet filter rule to the system, however, the rule doesn't appear to work. I added a rule stating that a single host (defined in DEFINITIONS-->NETWORKS) Allow ANY to my EXTERNAL(network). I then try to access anything from that host and the log shows the packets being dropped.

Any ideas?

- Ken

PS - I already read the quickstart guides. I will look over it again. Thank you for the tip!
Cancel
Vote Up 0 Vote Down

Cancel
0 BrucekConvergent over 19 years ago in reply to kwermann

The definition should be: Internal host (or network) -> ANY (not "External" network) with whatever services you want (any is fine, but a more granular approach is better). Also, if you want to take advantage of the Web Protection license (I'm assuming you have this, most of our customers buy it) which enables AV scanning and content filtering of HTTP traffic, you'll want to use the HTTP Proxy to take advantage of that.

Oh, and if you haven't done it already.. you need a NAT MASQ rule setup.. Internal Network -> MASQ -> External Astaro Address.
Cancel
Vote Up 0 Vote Down

Cancel
0 kwermann over 19 years ago in reply to BrucekConvergent

Hi Guys,

Thank you much, I was able to get my browsing up and running. Now off to other configuration.

Thanks again!

- Ken
Cancel
Vote Up 0 Vote Down

Cancel
0 BrucekConvergent over 19 years ago in reply to kwermann

So what was missing?
Cancel
Vote Up 0 Vote Down

Cancel
0 kwermann over 19 years ago in reply to BrucekConvergent

I didn't understand how Astaro's ASG handled masquerading versus routing. The method works different than other devices I have played with in the past. All I needed to do was properly set the masquerade settings and BAM, I was on the internet.

Thanks for the help all!
Cancel
Vote Up 0 Vote Down

Cancel
0 krolla over 19 years ago in reply to kwermann

I'm having the same issue.. How do you have Masq setup now?
Cancel
Vote Up 0 Vote Down

Cancel
0 adder over 19 years ago in reply to krolla

I use http proxy WITHOUT any nat/masquerading set up and it just works!
Cancel
Vote Up 0 Vote Down

Cancel