0

I am trying to set up port forwarding on my Cisco ASA security appliance. I have tried several tutorials and can not seem to get it to work.

The ASA is set up behind my internet providers gateway. The gateway has assigned an IP address of 176.16.1.66/24 to the ASA on the external interface.

My internal interface is 10.1.1.254/24

I have run the following commands to create the Access Rules and NAT Rules.

object network web_server

host 10.1.1.40

nat (internal,external) static interface service tcp 80 80

access-list EXTERNAL extended permit tcp any host 10.1.1.40 eq www

access-group EXTERNAL in interface external

If I try to connect to the external IP address (via a cell phones mobile connection) I get the following error on Log Viewer

TCP access denied by ACL from 14x.xxx.xxx.230/61525 to external:172.16.1.66/80

I have also tried running the packet tracer and its failing on the second NAT step. enter image description here

Hopefully I am making an obvious mistake as I can not seem to find where I am going wrong.

Thanks

  • I see a typo -- may be in your question, or may be in your config: 176.16.1.66 is your interface, but log says 172.16.1.66 – Ron Trunk May 26 at 13:01
  • Also, your packet-tracer test should use the external address. You're simulating an outside host; they aren't going to directly access "10.1.1.40". – Ricky Beam May 26 at 15:41
0

It seems your NAT precedence is incorrect.

Your image lists this:

enter image description here

That is a Manual NAT statement. Which means it occures before any Auto NAT rules. Like the one you are trying to apply:

object network web_server
 host 10.1.1.40
 nat (internal,external) static interface service tcp 80 80

To fix this you'll either have to reconfigure your Port Forward using Manual NAT and specify a line number numerically lower than the Dynamic PAT in the image above. Or, you could move the Dynamic PAT to the "after-auto" section so it takes place after auto-nat statements. I recommend the latter.

To learn more about ASA NAT Precedence, see this article.

| improve this answer | |
  • 1
    Thank you. This fixed my issue. I now vaguely remember doing this years ago but completely missed it! In the ASDM there are arrows the adjust the order, I somehow overlooked these and could only drag to change the order of the Auto rules not the Manual rule. – Kyle May 26 at 18:44
0
object network obj-192.168.1.2
 host 192.168.1.2
object network obj_any
 subnet 0.0.0.0 0.0.0.0
object service dest-tcp-2502
 service tcp destination eq 2502
object service dest-tcp-9901
 service tcp destination eq 9901

access-list acl-internet-in extended permit tcp any4 object obj-192.168.1.2 eq 2502

nat (outside,inside) source static obj_any interface destination static interface obj-192.168.1.2 service dest-tcp-9901 dest-tcp-2502 unidirectional no-proxy-arp

This is actually "twice NAT". I need the inside host (1.2) to see the ASA as the source of the connection so the traffic will always go back to this specific ASA -- because it's not the default gateway. "unidirectional" is used to prevent matching outbound traffic. And "no-proxy-arp" stops the ASA from claiming to be the referenced hosts. (one them being "any")

Phase: 1
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
nat (outside,inside) source static obj_any interface destination static interface obj-192.168.1.2 service dest-tcp-9901 dest-tcp-25
02 unidirectional no-proxy-arp
Additional Information:
NAT divert to egress interface inside
Untranslate (outside)/9901 to 192.168.1.2/2502

Phase: 3
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group acl-internet-in in interface outside control-plane
access-list acl-internet-in extended permit tcp any4 object obj-192.168.1.2 eq 2502

Phase: 4
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (outside,inside) source static obj_any interface destination static interface obj-192.168.1.2 service dest-tcp-9901 dest-tcp-2502 unidirectional no-proxy-arp
Additional Information:
Static translate 4.2.2.1/44444 to (inside)/44444

(1.2) sees a connection from [inside]:44444 to (1.2):2502. (if 44444 was in use, it gets translated too.)

| improve this answer | |
0
! ... because "new NAT" is stupid
object network obj-192.168.253.17-00
 host 192.168.253.17
object network obj-192.168.253.17-01
 host 192.168.253.17
object network obj-192.168.253.17-02
 host 192.168.253.17
object network obj-192.168.253.17-03
 host 192.168.253.17

object-group service svc-main tcp
 port-object eq ftp
 port-object eq ftp-data
 port-object eq www
 port-object eq https

access-list acl-lvl3 extended permit tcp any4 host 192.168.253.17 object-group svc-main

object network obj-192.168.253.17-00
 nat (DMZ,lvl3) static interface service tcp www www
object network obj-192.168.253.17-01
 nat (DMZ,lvl3) static interface service tcp https https
object network obj-192.168.253.17-02
 nat (DMZ,lvl3) static 4...6 service tcp ftp ftp
object network obj-192.168.253.17-03
 nat (DMZ,lvl3) static 4...6 service tcp ftp-data ftp-data

That's how I map services (http, https, and ftp) to the DMZ host (253.17). Web services are accessed by the interface IP, and ftp uses a different address in the same network.

You may have your nat backwards. (interfaces swapped) Or just "give in" and use auto-nat -- "object nat" as I've done. (it's absolutely insane, but do-it-and-walk-away. Yes, it turns a single 8.2 cfg line into a completely redundant mess. Here, 4 became 16, and it's the cleanest example -- the full config went from 423 lines to 677!)

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.