3

ASA keeps denying TCP to PAT'd DMZ IP. Could someone have a look at this, i have mostly been using ASDM.

same-security-traffic permit intra-interface  
object network expressway-e  
 host 192.168.5.21  
 description expressway inside  
object network expressway-e-dmz  
 host 10.1.0.21  
 description expressway dmz interface  
object network inside-all  
 subnet 192.168.0.0 255.255.0.0  
object network DMZ  
 subnet 10.1.0.0 255.255.255.0  
 description DMZ Subnet Object  
object network obj-192.168.0.0-01  
 subnet 192.168.0.0 255.255.0.0  
object service udp_3478-3483  
 service udp source range 3478 3483   
object service udp_24000-29999  
 service udp source range 24000 29999   
object service udp_36002-59999  
 service udp source range 36002 59999   
object service tcp_5222  
 service tcp source eq 5222  
 object service tcp_8443  
 service tcp source eq 8443   
object service tcp_5061  
 service tcp source eq 5061   
object service udp_5061  
 service udp source eq 5061   
object network Outside-Interface  
 host 74.32.58.14  
object network ASA-DMZ-Interface  
 host 10.1.0.1  
object network DMZ_outside  
 subnet 0.0.0.0 0.0.0.0  
object network expressway-server-Outside  
 host 10.1.0.21  
object-group network obj-192.168.0.0  
 description Inside Vlan1  
 network-object 192.168.0.0 255.255.0.0  
object-group network obj-192.168.1.0  
object-group network obj-192.168.10.0  
 description Network Management subnet  
object-group service DM_INLINE_SERVICE_1  
 service-object icmp     
service-object icmp time-exceeded  
object-group protocol TCPUDP  
 protocol-object udp  
 protocol-object tcp  
object-group network obj-10.1.0.0  
 network-object DMZ 255.255.255.0  
object-group service tcp-expressway tcp  
 port-object eq 5222  
 port-object eq 8443  
object-group service udp-expressway udp  
 port-object range 23999 30000  
 port-object range 3477 3484  
 port-object range 36001 60000  
 port-object eq 5061  
 port-object eq 5222  
 port-object eq 8443  
access-list inside_access_in remark Permit Ping  
access-list inside_access_in extended permit ip any4 any4   
access-list outside_access_in remark outside_in_acl  
access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any4 any4   
access-list outside_access_in extended permit udp any4 object expressway-e-dmz object-group udp-expressway   
access-list outside_access_in extended permit tcp any4 object expressway-e-dmz object-group tcp-expressway   
access-list inside_access_in_1 extended permit ip any4 any4   
access-list global_mpc extended permit ip any4 any4   
access-list DMZ_access_in extended permit ip any4 object DMZ   
access-list DMZ_access_in remark Permit/Allow icmp from Inside  
access-list DMZ_access_in extended permit icmp 192.168.2.0 255.255.255.0 object DMZ   
access-list dmz_access_in extended permit ip object DMZ any4   
access-list dmz_access_in extended permit ip   object DMZ object inside-all   
access-list global_mpc_1 remark This allowed ping from inside networks to DMZ hosts  
access-list global_mpc_1 extended permit icmp object inside-all 10.1.0.0 255.255.255.0   
access-list global_mpc_2 extended permit icmp object inside-all object ASA-DMZ-Interface   
access-list OutsideToDMZ extended permit tcp any4 host 10.1.0.21 eq 5222   
access-list OutsideToDMZ extended permit tcp any4 host 10.1.0.21 eq 8443   
access-list OutsideToDMZ extended permit tcp any4 host 10.1.0.21 eq 5061   
access-list OutsideToDMZ extended permit udp any4 host 10.1.0.21 gt 3477   
access-list OutsideToDMZ extended permit udp any4 host 10.1.0.21 lt 3484   
access-list OutsideToDMZ extended permit udp any4 host 10.1.0.21 gt 23999   
access-list OutsideToDMZ extended permit udp any4 host 10.1.0.21 lt 30000   
access-list OutsideToDMZ extended permit udp any4 host 10.1.0.21 gt 36001   
access-list OutsideToDMZ extended permit udp any4 host 10.1.0.21 lt 60000   
access-list OutsideToDMZ extended permit udp any4 host 10.1.0.21 eq 5061   
*remove*
object network inside-all  
 nat (inside,dmz) static 10.1.0.0  
object network DMZ  
 nat (dmz,outside) dynamic interface  
!
nat (dmz,outside) after-auto source static expressway-server-Outside expressway-server-Outside service udp_24000-29999 udp_24000-29999  
nat (dmz,outside) after-auto source dynamic expressway-server-Outside expressway-server-Outside service tcp_8443 tcp_8443  
nat (dmz,outside) after-auto source static expressway-server-Outside expressway-server-Outside service udp_36002-59999 udp_36002-59999  
nat (dmz,outside) after-auto source static expressway-server-Outside expressway-server-Outside service tcp_5222 tcp_5222
nat (dmz,outside) after-auto source static expressway-server-Outside expressway-server-Outside service udp_3478-3483 udp_3478-3483
nat (dmz,outside) after-auto source static expressway-server-Outside expressway-server-Outside service tcp_5061 tcp_5061
nat (dmz,outside) after-auto source static expressway-server-Outside expressway-server-Outside service udp_5061 udp_5061
nat (inside,outside) after-auto source dynamic any interface  
access-group inside_access_in_1 in interface inside control-plane  
access-group inside_access_in in interface inside  
access-group OutsideToDMZ in interface outside  
access-group dmz_access_in in interface dmz  
  • 3
    You need to show us the error and point out which NAT entry you're having the problem with. – Jesse P. Jan 23 at 16:06
  • When i attempt a connection from the internet to what I believe is set for 'port forwarding', i get the following deny in the ASA log: TCP request descarded from x.x.x.x/port to outside:x.x.x.x/8443 – Larry G Jan 23 at 21:23
  • I have seen other posts with the same symptom. – Larry G Jan 23 at 21:26
5
object network DMZ
 nat (dmz,outside) dynamic interface

This statement is part of your problem. You have this "global" NAT that has been given higher priority than:

nat (dmz,outside) after-auto source dynamic expressway-server-Outside expressway-server-Outside service tcp_8443 tcp_8443

Because you used the keyword "after-auto".

If you issue the command "show nat" (not show run nat) you will see the order in which the NAT statements are processed. Because of the after-auto keyword, it has the least priority in NAT processing and is a sort of "last resort". If you remove that keyword from that particular NAT statement, you should be fine.

It's generally a better practice to only use the after-auto keyword on your global NAT statements, not service NATs. So, you give lowest priority to your "if there's no other match, use this" statements.

So, I'd do the following:

object network DMZ
 no nat (dmz,outside) dynamic interface

nat (dmz,outside) after-auto source dynamic DMZ interface (to make sure it's only the DMZ subnet on that DMZ interface)

or

nat (dmz,outside) after-auto source dynamic any interface (since you're already limiting to the DMZ interface)

Followed by:

no nat (dmz,outside) after-auto source dynamic expressway-server-Outside expressway-server-Outside service tcp_8443 tcp_8443

nat (dmz,outside) source dynamic expressway-server-Outside expressway-server-Outside service tcp_8443 tcp_8443
  • I followed these steps and I still get that deny on the outside. Packet Tracer output - Action Drop Config Implicit Rule. Jesse thanks for your patience this started out as a UC lesson and has turned into an ASA lesson. Thanks again – Larry G Jan 24 at 13:03
  • @LarryG Can you edit your question with the output of "show nat" along with an example of your packet-tracer output from your tests? – Jesse P. Jan 24 at 13:07
  • As a follow up to this, I noticed that there were some service policy rules in place. I removed all of those, and removed all of my previous entries for NAT and Access rules. I followed Jesse's suggestions for the NAT which now this seems to be working, no deny's on TCP/8443. – Larry G Jan 24 at 21:21
  • @LarryG Cool. Glad you got it working. Please mark my answer as the solution or add your own andwer and mark it, so this question doesn't keep coming up forever. – Jesse P. Jan 24 at 21:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.