I need help to resolve this issue. I have a Cisco ASA 5512 and I’m trying to access to my FTP server from external IP but the packets are dropped. Please find the network diagram below:
I typed this commands:
object network FTPServer
host 10.3.3.128
nat (Inside,Outside) static interface service tcp 21 21
access-list Outside_access_in extended permit tcp any object FTPServer eq ftp
The packets are dropped by NAT rule, here’s the packet-tracer result:
packet-tracer input outside tcp 193.252.204.12 12345 10.3.3.128 21
Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 10.3.3.0 255.255.255.0 Inside
Phase: 2
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group Outside_access_in in interface Outside
access-list Outside_access_in extended permit tcp any object FTPServer eq ftp
Additional Information:
Phase: 3
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
Phase: 4
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Phase: 5
Type: INSPECT
Subtype: inspect-ftp
Result: ALLOW
Config:
class-map inspection_default
match default-inspection-traffic
policy-map global_policy
class inspection_default
inspect ftp
service-policy global_policy global
Additional Information:
Phase: 6
Type: NAT
Subtype: rpf-check
Result: DROP
Config:
object network FTPServer
nat (Inside,Outside) static interface service tcp ftp ftp
Additional Information:
Result:
input-interface: Outside
input-status: up
input-line-status: up
output-interface: Inside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule
Please find the full configuration below:
ASA Version 9.1(2)
!
hostname ASA
names
ip local pool PoolVPN 192.168.33.100-192.168.33.150 mask 255.255.255.0
!
interface GigabitEthernet0/0
nameif Outside
security-level 0
ip address 62.X.X.226 255.255.255.248
!
interface GigabitEthernet0/1
nameif Inside
security-level 100
ip address 10.3.3.48 255.255.255.0
!
interface GigabitEthernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/4
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/5
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
management-only
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
!
ftp mode passive
object network LanLOCAL
subnet 10.3.3.0 255.255.255.0
object network PoolVPN
subnet 192.168.33.0 255.255.255.0
object network FTPServer
host 10.3.3.128
access-list Inside_access_out extended permit ip 10.3.3.0 255.255.255.0 object PoolVPN log disable
access-list Outside_access_in extended permit tcp any object FTPServer eq ftp
pager lines 24
logging enable
logging asdm informational
mtu Outside 1500
mtu Inside 1500
mtu management 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (Inside,Outside) source static any any destination static PoolVPN PoolVPN no-proxy-arp route-lookup
!
object network FTPServer
nat (Inside,Outside) static interface service tcp ftp ftp
!
nat (Inside,Outside) after-auto source dynamic LanLOCAL interface
access-group Outside_access_in in interface Outside
route Outside 0.0.0.0 0.0.0.0 62.X.X.225 1
route Inside 10.0.0.0 255.0.0.0 10.3.3.250 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 management
http 10.0.0.0 255.0.0.0 Inside
no snmp-server location
no snmp-server contact
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpoint _SmartCallHome_ServerCA
no validation-usage
crl configure
crypto ca trustpool policy
telnet timeout 5
ssh 10.0.0.0 255.0.0.0 Inside
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd enable management
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
enable Outside
anyconnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1
anyconnect image disk0:/anyconnect-macosx-i386-2.5.2014-k9.pkg 2
anyconnect enable
tunnel-group-list enable
cache
disable
error-recovery disable
group-policy GroupPolicy_VPN-Test internal
group-policy GroupPolicy_VPN-Test attributes
wins-server none
dns-server value 10.3.3.5
vpn-tunnel-protocol ssl-client
default-domain value TEST.local
tunnel-group VPN-Test type remote-access
tunnel-group VPN-Test general-attributes
address-pool PoolVPN
default-group-policy GroupPolicy_VPN-Test
tunnel-group VPN-Test webvpn-attributes
group-alias VPN-Test enable
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
!
service-policy global_policy global
prompt hostname context
call-home reporting anonymous
Cryptochecksum:72ad3302b53c0add5a8574806a963e27
: end
Can anyone help me?
