AWS DataCenter
----------- site-to-site VPN ------------
http server <=======================> Cisco ASA public address
10.0.1.59:443 109.1.2.27:8443
AWS VPC (with a web server) connects via a site-to-site VPN to DataCenter. There is a public address on the outside of the ASA at DataCenter that I want to NAT the webserver in AWS to. If the web server were inside the LAN behind DataCenter's ASA, this would be easy. I do that already. Basically I need to keep the public address of the server the same, but move it from the DataCenter to a branch office that's connected to DataCenter's ASA.
I've tried this:
nat (outside,outside) source static 10.0.1.59 109.1.2.3 service http http8443
but it doesn't work.
I do have same-security-traffic enabled.
same-security-traffic permit intra-interface
The ASA is version 9.9(2).
And no, I can't change the public IP and I can't move the IP to branch office.
Thanks in advance,
Edit: ASA config:
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
!
interface GigabitEthernet1/1
nameif inside
security-level 100
ip address 192.168.2.98 255.255.255.0
!
interface GigabitEthernet1/3
nameif outside
security-level 0
ip address 109.1.2.26 255.255.255.248
!
ftp mode passive
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network company-inside-datacenter
subnet 192.168.2.0 255.255.255.0
object network webserver
host 192.168.2.24
object network public-address
host 109.1.2.27
object service https
service tcp source eq https
object service https8443
service tcp source eq 8443
object network obj-amzn
subnet 10.0.0.0 255.255.0.0
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network webserver-aws
host 10.0.1.59
object-group network datacenter-etc
network-object 192.168.2.0 255.255.255.0
access-list nonat extended permit ip any4 192.168.2.0 255.255.255.0
access-list inside_access_in extended permit ip 192.168.2.0 255.255.255.0 any4
access-list outside_access_in extended permit tcp any4 object webserver eq https
access-list outside_access_in extended permit object https8443 any4 object webserver-aws
access-list acl-amzn extended permit ip any4 10.0.0.0 255.255.0.0
access-list inside_access_in_3 extended permit ip any4 any4
nat (inside,any) source static any any destination static company-inside-datacenter company-inside-datacenter no-proxy-arp route-lookup
nat (inside,outside) source static webserver public-address service https https
nat (outside,outside) source static webserver-aws public-address service https https8443 no-proxy-arp
nat (inside,outside) source static company-inside-datacenter company-inside-datacenter destination static group-remote-aws group-remote-aws no-proxy-arp route-lookup
nat (outside,outside) source static datacenter-etc datacenter-etc destination static obj-amzn obj-amzn no-proxy-arp route-lookup
nat (inside,outside) source static datacenter-etc datacenter-etc destination static obj-amzn obj-amzn no-proxy-arp route-lookup
object network company-inside-datacenter
nat (outside,outside) dynamic interface
object network obj_any
nat (inside,outside) dynamic interface
access-group inside_access_in_3 in interface inside
access-group outside_access_in in interface outside
access-group global_access global
route outside 0.0.0.0 0.0.0.0 109.1.2.25 1
sysopt connection tcpmss 1300
service sw-reset-button
crypto ipsec security-association pmtu-aging infinite
crypto dynamic-map outside_dyn_map 20 set ikev1 transform-set ESP-AES256-SHA1_TRANS ESP-AES128-SHA1_TRANS ESP-AES256-SHA1
crypto map outside_map 300 match address acl-amzn
crypto map outside_map 300 set pfs
crypto map outside_map 300 set peer 53.53.53.27 53.53.53.32
crypto map outside_map 300 set ikev1 transform-set transform-amzn
crypto map outside_map 300 set security-association lifetime seconds 3600
crypto map outside_map 300 set reverse-route
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
management-access inside
no vpn-addr-assign dhcp
vpn-addr-assign local reuse-delay 1
dhcprelay timeout 60
group-policy DfltGrpPolicy attributes
vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-clientless
group-policy AmznGrpPolicy internal
group-policy AmznGrpPolicy attributes
vpn-idle-timeout 30
vpn-session-timeout none
vpn-filter none
vpn-tunnel-protocol ikev1
split-tunnel-all-dns disable
dynamic-access-policy-record DfltAccessPolicy
tunnel-group 53.53.53.27 type ipsec-l2l
tunnel-group 53.53.53.27 general-attributes
default-group-policy AmznGrpPolicy
tunnel-group 53.53.53.27 ipsec-attributes
ikev1 pre-shared-key *******************
isakmp keepalive threshold 10 retry 3
ikev2 remote-authentication pre-shared-key *******************
ikev2 local-authentication pre-shared-key *******************
tunnel-group 53.53.53.32 type ipsec-l2l
tunnel-group 53.53.53.32 general-attributes
default-group-policy AmznGrpPolicy
tunnel-group 53.53.53.32 ipsec-attributes
ikev1 pre-shared-key *******************
isakmp keepalive threshold 10 retry 3
ikev2 remote-authentication pre-shared-key *******************
ikev2 local-authentication pre-shared-key *******************
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 4096
no tcp-inspection
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
class class-default
user-statistics accounting
!
service-policy global_policy global
This is a very stripped down/sanitized config with all addresses/names changed and lots of unrelated VPN tunnels removed.
The current server that's NAT'd to the public-address is "webserver". The new server that I need to NAT to the same thing is "webserver-aws" (a server inside an AWS VPC that's connected to the ASA via the Site-Site VPN). I'm trying to set it up concurrently to test, so current server is exposing tcp443 as tcp443 and my test entry is trying to expose the new server on tcp8443 for testing.
Edit 2:
After trying @Ricky's answer with and without no-proxy-arp, this is my packet tracer result:
packet-tracer input outside tcp 0.0.0.1 1 109.1.2.27 8443 detailed
gave this
Phase: 1
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
found next-hop 109.1.2.27 using egress ifc outside
Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (nat-no-xlate-to-pat-pool) Connection to PAT address without pre-existing xlate