Cisco ASA Port Forwarding

Question

I am trying to set up port forwarding on my Cisco ASA security appliance. I have tried several tutorials and can not seem to get it to work.

The ASA is set up behind my internet providers gateway. The gateway has assigned an IP address of 176.16.1.66/24 to the ASA on the external interface.

My internal interface is 10.1.1.254/24

I have run the following commands to create the Access Rules and NAT Rules.

object network web_server

host 10.1.1.40

nat (internal,external) static interface service tcp 80 80

access-list EXTERNAL extended permit tcp any host 10.1.1.40 eq www

access-group EXTERNAL in interface external

If I try to connect to the external IP address (via a cell phones mobile connection) I get the following error on Log Viewer

TCP access denied by ACL from 14x.xxx.xxx.230/61525 to external:172.16.1.66/80

I have also tried running the packet tracer and its failing on the second NAT step.

Hopefully I am making an obvious mistake as I can not seem to find where I am going wrong.

Thanks

Answer 1

It seems your NAT precedence is incorrect.

Your image lists this:

That is a Manual NAT statement. Which means it occures before any Auto NAT rules. Like the one you are trying to apply:

object network web_server
 host 10.1.1.40
 nat (internal,external) static interface service tcp 80 80

To fix this you'll either have to reconfigure your Port Forward using Manual NAT and specify a line number numerically lower than the Dynamic PAT in the image above. Or, you could move the Dynamic PAT to the "after-auto" section so it takes place after auto-nat statements. I recommend the latter.

To learn more about ASA NAT Precedence, see this article.

Answer 2

object network obj-192.168.1.2
 host 192.168.1.2
object network obj_any
 subnet 0.0.0.0 0.0.0.0
object service dest-tcp-2502
 service tcp destination eq 2502
object service dest-tcp-9901
 service tcp destination eq 9901

access-list acl-internet-in extended permit tcp any4 object obj-192.168.1.2 eq 2502

nat (outside,inside) source static obj_any interface destination static interface obj-192.168.1.2 service dest-tcp-9901 dest-tcp-2502 unidirectional no-proxy-arp

This is actually "twice NAT". I need the inside host (1.2) to see the ASA as the source of the connection so the traffic will always go back to this specific ASA -- because it's not the default gateway. "unidirectional" is used to prevent matching outbound traffic. And "no-proxy-arp" stops the ASA from claiming to be the referenced hosts. (one them being "any")

Phase: 1
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
nat (outside,inside) source static obj_any interface destination static interface obj-192.168.1.2 service dest-tcp-9901 dest-tcp-25
02 unidirectional no-proxy-arp
Additional Information:
NAT divert to egress interface inside
Untranslate (outside)/9901 to 192.168.1.2/2502

Phase: 3
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group acl-internet-in in interface outside control-plane
access-list acl-internet-in extended permit tcp any4 object obj-192.168.1.2 eq 2502

Phase: 4
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (outside,inside) source static obj_any interface destination static interface obj-192.168.1.2 service dest-tcp-9901 dest-tcp-2502 unidirectional no-proxy-arp
Additional Information:
Static translate 4.2.2.1/44444 to (inside)/44444

(1.2) sees a connection from [inside]:44444 to (1.2):2502. (if 44444 was in use, it gets translated too.)

Answer 3

! ... because "new NAT" is stupid
object network obj-192.168.253.17-00
 host 192.168.253.17
object network obj-192.168.253.17-01
 host 192.168.253.17
object network obj-192.168.253.17-02
 host 192.168.253.17
object network obj-192.168.253.17-03
 host 192.168.253.17

object-group service svc-main tcp
 port-object eq ftp
 port-object eq ftp-data
 port-object eq www
 port-object eq https

access-list acl-lvl3 extended permit tcp any4 host 192.168.253.17 object-group svc-main

object network obj-192.168.253.17-00
 nat (DMZ,lvl3) static interface service tcp www www
object network obj-192.168.253.17-01
 nat (DMZ,lvl3) static interface service tcp https https
object network obj-192.168.253.17-02
 nat (DMZ,lvl3) static 4...6 service tcp ftp ftp
object network obj-192.168.253.17-03
 nat (DMZ,lvl3) static 4...6 service tcp ftp-data ftp-data

That's how I map services (http, https, and ftp) to the DMZ host (253.17). Web services are accessed by the interface IP, and ftp uses a different address in the same network.

You may have your nat backwards. (interfaces swapped) Or just "give in" and use auto-nat -- "object nat" as I've done. (it's absolutely insane, but do-it-and-walk-away. Yes, it turns a single 8.2 cfg line into a completely redundant mess. Here, 4 became 16, and it's the cleanest example -- the full config went from 423 lines to 677!)