Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Cisco ASA (running ASA 8.4) which has a Site to Site IPsec tunnel to three sites.

These sites have overlapping address ranges, so on my ASA I have setup NAT so everything is accessible.

I now need to do some port forwarding, but I can't get it to work. I need to allow site1 to access port 4433 on 10.42.0.136 on our internal network.

They see our internal network as 10.84.0.0/24 (real subnet is 10.42.0.0/23 - that's supposed to be 23). We see their network as 10.43.1.0/24 (real subnet is 10.21.70.0/24).

My NAT config is as follows:

object network office-real
 subnet 10.42.0.0 255.255.254.0
object network office-nat
 range 10.84.0.10 10.84.0.254
object network site1-real
 subnet 10.21.70.0 255.255.255.0
object network site1-nat
 subnet 10.43.1.0 255.255.255.0
object network obj_any
 subnet 0.0.0.0 0.0.0.0
object network server1
 host 10.42.1.136

access-list outside-access-in extended permit icmp object site1-nat object office-real echo 
access-list outside-access-in extended permit icmp object site1-nat object office-real echo-reply 
access-list outside-access-in extended permit icmp object site1-nat object office-real source-quench 
access-list outside-access-in extended permit icmp object site1-nat object office-real unreachable 
access-list outside-access-in extended permit icmp object site1-nat object office-real time-exceeded 
! I know this could be made much better, i was just doing it to test! :)
access-list outside-access-in extended permit tcp any any eq 4433 
access-list outside-access-in extended deny ip any any log notifications 

! This will give our inside network a random address betwee 10.84.0.10-254, for connections going to 10.43.1.0/24 which are forwarded to 10.21.70.0/24
nat (inside,outside) source dynamic office-real office-nat destination static site1-nat site1-real

!             
object network server1
 ! I want 10.84.0.3:4433 to be forwarded to 10.42.1.136
 nat (inside,outside) static 10.84.0.3 service tcp 4433 4433 

!attach access-list
access-group outside-access-in in interface outside

I can't see why this won't work :( Anyone have any idea?

share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.