0

I am trying to make sense of the changes that Cisco has made to NAT on ASA > v8.3. I have a network which is being PAT'd to the outside interface address, and want to add a static NAT from the outside interface IP to a specific inside host.

Relevant bits of the config looks as so:

object network SERVER1
 host 192.168.198.7
 description INTERNAL SERVER
object service SERVER1-TCP-6000
 service tcp destination eq 6000
 access-list OUTSIDE-IN extended permit tcp object-group REMOTE-ACCESS object SERVER1 eq 6000 log emergencies
nat (INSIDE,OUTSIDE) source dynamic INSIDE-NET interface
nat (INSIDE,OUTSIDE) source static SERVER1 interface service SERVER1-TCP-6000 SERVER1-TCP-6000

Testing from addresses in REMOTE-ACCESS fails and packet tracer output shows the traffic is dropped:

fw1# packet-tracer input OUTSIDE tcp 1.1.1.2 1076 10.1.1.20 6000 detailed

Phase: 1
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
found next-hop ROUTER1.EXAMPLE.COM using egress ifc  identity

Phase: 2
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0x7f2e212c9870, priority=0, domain=nat-per-session, deny=false
    hits=30107923, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=6
    src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
    dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
    input_ifc=any, output_ifc=any

Phase: 3
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0x7f2e2c881270, priority=0, domain=permit, deny=true
    hits=4957308, user_data=0xa, cs_id=0x0, use_real_addr, flags=0x1000, protocol=0
    src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
    dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
    input_ifc=OUTSIDE, output_ifc=any

Result:
input-interface: OUTSIDE
input-status: up
input-line-status: up
output-interface: NP Identity Ifc
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

I find the new NAT config very confusing so grateful to anyone who could show me what I am missing here.

4
  • Need to see more of your configuration...
    – Ron Trunk
    May 3, 2016 at 18:40
  • Let me know what you need to see and will post it
    – btongeorge
    May 3, 2016 at 18:41
  • Pretty much the whole thing. Sanitize IP addresses if you need to.
    – Ron Trunk
    May 3, 2016 at 18:41
  • It's a pretty huge config, I'll have to cut some bits out for obvious reasons. Will unlikely have time to do this before Friday.
    – btongeorge
    May 3, 2016 at 19:10

0

You must log in to answer this question.

Browse other questions tagged .