1

I have a 2 devices, a Cisco ASA and sitting behind it another device. Both the Cisco and the other device have IPsec tunnels but to different locations. I need to ensure that the source port of the other device is not UDP-500 when it is NAT'd, as that is the same port as the Cisco IPsec service and so we see a problem where reply packets destined for the other device instead hit the ASA.

According to Cisco's FAQ on NAT (http://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/26704-nat-faq-00.html) it preserves the port where possible by default based on "Q. When configuring for PAT (overloading), what is the maximum number of translations that can be created per inside global IP address?"

Question: How can I force all PAT mappings to use source ports > 1024?

Alternatively, How can I force the ASA to ignore IPsec packets from a specific IP address and just treat them like normal NAT'd packets and forward them back to the internal device?

On linux iptables I would use something like: iptables -t nat -A POSTROUTING -o eth0 -p udp -j SNAT --to-source x.x.x.x:1024-30000

2
  • 1
    You might have better luck with this question over on networkengineering.se.com
    – alx9r
    Nov 22, 2014 at 0:45
  • Would it be easier to create a static NAT with a specific port for the internal IPSec device? Then it would be reachable from the outside in case the remote host needs to restart the tunnel, and the port number wouldn't change after a router reboot.
    – cpt_fink
    Nov 24, 2014 at 3:11

1 Answer 1

0

Solved it via another means, disabling IPsec access on the Cisco for the IPs that the internal device is communicating with. Did this via control-plane access lists:

ciscoasa(config)# access-list FILTER-VPN deny ip x.x.x.x y.y.y.y any

ciscoasa(config)# access-list FILTER-VPN permit ip any any

ciscoasa(config)# access-group FILTER-VPN in interface outside control-plane

(Source: https://supportforums.cisco.com/discussion/12001786/restrict-certain-ip-addresses-establishing-ipsec)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .