Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to setup NAT translation on a ASA 5505, however the new public IP address never actually becomes available after adding it. I'm sure I'm doing something stupid, but so far the problem has eluded me. Basically, I'm trying to map XX.XX.115.195 => 192.168.125.7. XX.XX.115.194 is the public IP of the firewall, and it is accessible, but 115.195 never seems to get picked up. I inherited the original configuration so it is possible that one of the other rules is preventing this from happening. I've included what I believe are the relevant sections below.

Below is the specific rule I added. I've confirmed I'm able to reach the 125.7 server from inside the firewall on the usual ports and protocols, but from the outside the public 115.195 does not respond to anything.

static (outside,inside) 192.168.125.7 XX.XX.115.195 netmask 255.255.255.255
ASA Version 7.2(4) 
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.125.1 255.255.255.0 
!
interface Vlan2
 nameif outside
 security-level 0
 ip address XX.XX.115.194 255.255.255.248 
!
access-list outside-in extended permit tcp any host XX.XX.115.194 eq 44000 
access-list outside-in extended permit tcp any host XX.XX.115.194 eq https 
access-list outside-in extended permit tcp any host XX.XX.115.194 eq 4000 
access-list inside_nat0_outbound extended permit ip any 192.168.125.192 255.255.255.192

nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp interface 44000 192.168.125.15 44000 netmask 255.255.255.255 
static (inside,outside) tcp interface https 192.168.125.15 https netmask 255.255.255.255 
static (inside,outside) tcp interface 4000 192.168.125.15 4000 netmask 255.255.255.255 
static (outside,inside) 192.168.125.7 XX.XX.115.195 netmask 255.255.255.255
access-group outside-in in interface outside
share|improve this question
    
It may be a typo but it looks like you are defining 2 different addresses. XX.XX.115.195 for the static translation and XX.XX.115.194 in the ACLs. –  Rik Schneider Aug 1 '12 at 20:00
    
115.194 is used for a different NAT translation. I added the following ACL for 115.195 (access-list outside-in extended permit ip any host XX.XX.115.195) I wanted all ports/protocols allowed –  John P Aug 1 '12 at 20:23

2 Answers 2

You have your NAT statement flipped... it should be

static (inside,outside)  XX.XX.115.195 192.168.125.7 netmask 255.255.255.255

After doing this, your ACLs need to permit inbound traffic

share|improve this answer
    
I removed the old rule and added the following:<pre>static (inside,outside) XX.XX.115.195 192.168.125.7 netmask 255.255.255.255 access-list outside-in extended permit ip any host XX.XX.115.195 But still having the same issue –  John P Aug 1 '12 at 20:07
    
which ACL did you modify to allow inbound traffic to this NAT? Going back to Ric's comment, did you intend to both 115.195 and 115.194 on the "outside" interface? –  Mike Pennington Aug 1 '12 at 20:10
    
access-list outside-in extended permit ip any host XX.XX.115.195 –  John P Aug 1 '12 at 20:11
    
What about Ric's comment? –  Mike Pennington Aug 1 '12 at 20:12
    
the 115.194 was a preexisting configuration ( I inherited the firewall management ) –  John P Aug 1 '12 at 20:24

Did you add the matching ACL to allow inbound traffic on that IP address?

It looks like you have ACL's for the x.x.115.194 address to allow https/ports 44000/4000 inbound. You need to add matching ACL's for the ports you want to allow on the x.x.115.195 address

share|improve this answer
    
added the following, but having same issue: access-list outside-in extended permit ip any host XX.XX.115.195 –  John P Aug 1 '12 at 20:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.