Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Cisco ASA (running ASA 8.4) which has a Site to Site IPsec tunnel to three sites.

These sites have overlapping address ranges, so on my ASA I have setup NAT so everything is accessible.

I now need to do some port forwarding, but I can't get it to work. I need to allow site1 to access port 4433 on 10.42.0.136 on our internal network.

They see our internal network as 10.84.0.0/24 (real subnet is 10.42.0.0/23 - that's supposed to be 23). We see their network as 10.43.1.0/24 (real subnet is 10.21.70.0/24).

My NAT config is as follows:

object network office-real
 subnet 10.42.0.0 255.255.254.0
object network office-nat
 range 10.84.0.10 10.84.0.254
object network site1-real
 subnet 10.21.70.0 255.255.255.0
object network site1-nat
 subnet 10.43.1.0 255.255.255.0
object network obj_any
 subnet 0.0.0.0 0.0.0.0
object network server1
 host 10.42.1.136

access-list outside-access-in extended permit icmp object site1-nat object office-real echo 
access-list outside-access-in extended permit icmp object site1-nat object office-real echo-reply 
access-list outside-access-in extended permit icmp object site1-nat object office-real source-quench 
access-list outside-access-in extended permit icmp object site1-nat object office-real unreachable 
access-list outside-access-in extended permit icmp object site1-nat object office-real time-exceeded 
! I know this could be made much better, i was just doing it to test! :)
access-list outside-access-in extended permit tcp any any eq 4433 
access-list outside-access-in extended deny ip any any log notifications 

! This will give our inside network a random address betwee 10.84.0.10-254, for connections going to 10.43.1.0/24 which are forwarded to 10.21.70.0/24
nat (inside,outside) source dynamic office-real office-nat destination static site1-nat site1-real

!             
object network server1
 ! I want 10.84.0.3:4433 to be forwarded to 10.42.1.136
 nat (inside,outside) static 10.84.0.3 service tcp 4433 4433 

!attach access-list
access-group outside-access-in in interface outside

I can't see why this won't work :( Anyone have any idea?

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.