2
object network obj-10.15.X.Y
 host 10.15.X.X
 nat (inside,outside) static 1.1.1.1

sh xlate | in 1.1.1.1                 
NAT from inside:10.15.X.Y to outside:1.1.1.1

access-list External_Access extended permit ip object-group WhiteList host 10.15.X.Y

applied on the outside interface - in bound.

I am trying to access the public IP address (1.1.1.1) from one of the IP addresses in the object-group Whitelist.

Is the above ACL the correct one since I already have the NAT in place?

Or should I use something like:

access-list External_Access extended permit ip object-group WhiteList host 1.1.1.1
2
  • What ASA version?
    – D3l_Gato
    Mar 3 '16 at 16:36
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 7 '17 at 19:44
4

Since ASA 8.3 code, the interface ACLs expect the real-ip in each statement.

In your example, your real-ip is 10.15.x.x.

As such, your ACL entry will have to look like this:

access-list External_Access extended permit ip object-group WhiteList host 10.15.x.x

Alternatively, and I think more easily, you can just use the object reference directly in the ACL statement:

access-list External_Access extended permit ip object-group WhiteList object obj-10.15.X.Y
                                                                      ^^^^^^^^^^^^^^^^^^^^

Another way of looking at it is in 8.3+ code, the NAT happens before the ACL. In 8.2- code, the NAT happens after the ACL.

0
0

Looks like an old ASA 8.something.

Your inside interface should be set to security-level 100 and outside to 0. You shouldnt need an ACL to route to the outside and NAT the traffic.

0

it will be as below:

access-list External_Access extended permit ip object-group WhiteList object obj-10.15.X.Y

because your IP address is 10.15.X.X and you are including 10.15.X.Y in the ACL, or you can do as below:

access-list External_Access extended permit ip object-group WhiteList host 10.15.X.X

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.