1

I configured a Cisco ASA, and NAT was configured fine. But now, I have to open some ports there, and all it shows is this error:

Address x.x.x.x overlaps with public ip and the nat is not downloaded

What could be the problem?

Cisco ASA version 9.2(2)4 and ASDM version 7.2(2)1enter image description here

interface GigabitEthernet0/0
 nameif Public-IP
 security-level 0
 ip address x.x.x.x 255.255.255.0 

interface GigabitEthernet0/5
 nameif Global-wireless
 security-level 70
 ip address 192.168.0.1 255.255.255.0 
!
interface Management0/0
 management-only
 nameif management
 security-level 100
 ip address 192.168.1.1 255.255.255.0 

same-security-traffic permit inter-interface
same-security-traffic permit intra-interface

object network global-wireless-subnet
 subnet 192.168.0.0 255.255.255.0

object network obj-192.168.0.205
host 192.168.0.205
nat (global-wireless,public-IP) static x.x.x.x service tcp 4370 4370

ERROR: Address x.x.x.x overlaps with Public-IP interface address.
ERROR: NAT Policy is not downloaded

Note: I read today that instead of IP, I should use address, and I am yet to test it. I will do the testing tomorrow.

Improve this question
2
  • You need to edit your question to provide more information. Show your configuration (sanitize any public IP addresses), and then show the commands you are entering and the resulting error(s).
    – Ron Maupin ♦
    Apr 30, 2016 at 15:08
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 7, 2017 at 21:06

1 Answer 1

Reset to default
2

If you are using static object NAT this way with the outside interface IP as a mapped IP - you have to use "interface" instead of using a specific interface IP.

nat (global-wireless,public-IP) static interface service tcp 4370 4370

Improve this answer
4
  • Hi Vieplis thank you for your answer. I did use the NAT as you have stated but still i am not being able to open port 4370. then i added access list as "access-list global-public extended permit tcp any host x.x.x.x eq 4370" where x.x.x.x is my public ip yet i couldn't open the ports. What could be the issue.
    – de.walkar
    May 2, 2016 at 5:10
  • from 8.3 onwards, you have to use private IP (sometimes called real IP within Cisco documentation) for the access list, so x.x.x.x should be no the public IP, but inside/private IP.
    – Vieplis
    May 2, 2016 at 16:36
  • So you mean the command should be "access-list global-public extended permit tcp any host 192.168.0.205 eq 4370 "? After this command do we still have to use "access-group global-public in interface public" command?
    – de.walkar
    May 3, 2016 at 4:31
  • Yes, you still have to apply the access list to the outside (public) interface, otherwise traffic won't be allowed by ASA, assuming you have a classic design of security levels where outside interface has lower security level than inside - that is how ASA handles traffic.
    – Vieplis
    May 4, 2016 at 15:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.