2

I have cisco ASA 5515-x running version 9.2. I want to port forward the request on 80 to 9006 which is of my DVR.

I did this :

object network obj-10.10.26.6
  host 10.10.26.6
object network obj-203.156.213.173
  host 203.156.213.173
object service port-80
  service tcp source eq 80
object service port-9006
  service tcp destination eq 9006

nat (inside,public-IP) source static obj-10.10.26.6 obj-203.156.213.173 service port-80 port-9006

I get this following error when I do port forwarding in the pool IP:

pac in public-IP tcp 8.8.8.8 12345 203.156.213.173 9006

Result:

input-interface: Public-IP
input-status: up
input-line-status: up
output-interface: Public-IP
output-status: up
output-line-status: up
Action: drop

Drop-reason: (nat-no-xlate-to-pat-pool) Connection to PAT address without pre-existing xlate

What am i doing wrong here? Why am i getting this error: "Drop-reason: (nat-no-xlate-to-pat-pool) Connection to PAT address without pre-existing xlate.

Actually, 201.135.201.73 is my Public IP and 203.156.213.173 is my pool IP that ISP has given and it is routable to my public ip.

Improve this question

2 Answers 2

Reset to default
2

Try:

no nat (inside,public-IP) source static obj-10.10.26.6 obj-203.156.213.173 service port-80 port-9006

object network obj-10.10.26.6
  host 10.10.26.6
  nat (inside,public-IP) static 203.156.213.173 service tcp port-80 port-9006

(or something similar, I'm doing this from memory).

Or, as I'm guessing that there is another (dynamic) nat statement before your static nat (but I don't have enough reputation yet to ask you in the comments, duh!), re-arrange the order so that the static comes first.

Improve this answer
0

If you're using source NAT then the ports should be set to source.

object service port-9006
 service tcp source eq 9006

Clear the translation table.

clear xlate
Improve this answer
4
  • Hello Mark. .... But opening certain ports for certain service in firewall is part of destination NAT, right?
    – de.walkar
    Aug 15, 2016 at 6:32
  • @de.walkar I see what you're saying... but it doesn't work like that. You're thinking because traffic is going to a server that it's destination NAT. Src/dst NAT depends on how you've set up your NAT statement. If you're modifying src address.. its src NAT. If you're modifying dst address, its dst NAT. On the ASA you can use either src or dst NAT and it will have the same effect. (IE you'll be able to reach it externally via pub IP). I usually use destination NAT on the ASA because its what makes sense in my head in regards to traffic flow. On IOS I use source NAT as I find it easier.
    – Mark
    Aug 15, 2016 at 8:07
  • @de.walkar also, NAT doesn't exactly open ports. It just tells the FW where to send the traffic that arrives on this port. The ACL does the opening ports part. Generally, if you do one without the other, it won't work... Unless your ACL allows all traffic or something.
    – Mark
    Aug 15, 2016 at 8:11
  • thank you for your answer. Yet this thing really bothers me. Can't understand it completely. In Fortigate, virtual IP works on destination NAT, right? Similarly, i thought opening port for certain task was part of destination NAT as remote user coming from public address have to get inside. For me source NAT was for internal users to go out to the internet. @Mark i am going to ask another question regarding this NAT, Can you please answer me there?
    – de.walkar
    Aug 16, 2016 at 4:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.