3 
AWS                                      DataCenter
-----------        site-to-site VPN      ------------
http server   <=======================>  Cisco ASA   public address
10.0.1.59:443                                         109.1.2.27:8443

AWS VPC (with a web server) connects via a site-to-site VPN to DataCenter. There is a public address on the outside of the ASA at DataCenter that I want to NAT the webserver in AWS to. If the web server were inside the LAN behind DataCenter's ASA, this would be easy. I do that already. Basically I need to keep the public address of the server the same, but move it from the DataCenter to a branch office that's connected to DataCenter's ASA.

I've tried this: nat (outside,outside) source static 10.0.1.59 109.1.2.3 service http http8443 but it doesn't work.

I do have same-security-traffic enabled.

same-security-traffic permit intra-interface

The ASA is version 9.9(2).

And no, I can't change the public IP and I can't move the IP to branch office.

Thanks in advance,

Edit: ASA config:


xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain

!
interface GigabitEthernet1/1
 nameif inside
 security-level 100
 ip address 192.168.2.98 255.255.255.0 
!
interface GigabitEthernet1/3
 nameif outside
 security-level 0
 ip address 109.1.2.26 255.255.255.248 
!
ftp mode passive
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface

object network company-inside-datacenter
 subnet 192.168.2.0 255.255.255.0

object network webserver
 host 192.168.2.24

object network public-address
 host 109.1.2.27

object service https
 service tcp source eq https 

object service https8443
 service tcp source eq 8443 

object network obj-amzn
 subnet 10.0.0.0 255.255.0.0

object network obj_any
 subnet 0.0.0.0 0.0.0.0

object network webserver-aws
 host 10.0.1.59

object-group network datacenter-etc
 network-object 192.168.2.0 255.255.255.0

access-list nonat extended permit ip any4 192.168.2.0 255.255.255.0 

access-list inside_access_in extended permit ip 192.168.2.0 255.255.255.0 any4 

access-list outside_access_in extended permit tcp any4 object webserver eq https 

access-list outside_access_in extended permit object https8443 any4 object webserver-aws 

access-list acl-amzn extended permit ip any4 10.0.0.0 255.255.0.0 

access-list inside_access_in_3 extended permit ip any4 any4 

nat (inside,any) source static any any destination static company-inside-datacenter company-inside-datacenter no-proxy-arp route-lookup

nat (inside,outside) source static webserver public-address service https https
nat (outside,outside) source static webserver-aws public-address service https https8443 no-proxy-arp

nat (inside,outside) source static company-inside-datacenter company-inside-datacenter destination static group-remote-aws group-remote-aws no-proxy-arp route-lookup
nat (outside,outside) source static datacenter-etc datacenter-etc destination static obj-amzn obj-amzn no-proxy-arp route-lookup
nat (inside,outside) source static datacenter-etc datacenter-etc destination static obj-amzn obj-amzn no-proxy-arp route-lookup

object network company-inside-datacenter
 nat (outside,outside) dynamic interface

object network obj_any
 nat (inside,outside) dynamic interface

access-group inside_access_in_3 in interface inside
access-group outside_access_in in interface outside
access-group global_access global

route outside 0.0.0.0 0.0.0.0 109.1.2.25 1

sysopt connection tcpmss 1300
service sw-reset-button

crypto ipsec security-association pmtu-aging infinite
crypto dynamic-map outside_dyn_map 20 set ikev1 transform-set ESP-AES256-SHA1_TRANS ESP-AES128-SHA1_TRANS ESP-AES256-SHA1

crypto map outside_map 300 match address acl-amzn
crypto map outside_map 300 set pfs 
crypto map outside_map 300 set peer 53.53.53.27 53.53.53.32 
crypto map outside_map 300 set ikev1 transform-set transform-amzn
crypto map outside_map 300 set security-association lifetime seconds 3600
crypto map outside_map 300 set reverse-route
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
management-access inside
no vpn-addr-assign dhcp
vpn-addr-assign local reuse-delay 1
dhcprelay timeout 60
group-policy DfltGrpPolicy attributes
 vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-clientless

group-policy AmznGrpPolicy internal
group-policy AmznGrpPolicy attributes
 vpn-idle-timeout 30
 vpn-session-timeout none
 vpn-filter none
 vpn-tunnel-protocol ikev1 
 split-tunnel-all-dns disable

dynamic-access-policy-record DfltAccessPolicy

tunnel-group 53.53.53.27 type ipsec-l2l
tunnel-group 53.53.53.27 general-attributes
 default-group-policy AmznGrpPolicy
tunnel-group 53.53.53.27 ipsec-attributes
 ikev1 pre-shared-key *******************
 isakmp keepalive threshold 10 retry 3
 ikev2 remote-authentication pre-shared-key *******************
 ikev2 local-authentication pre-shared-key *******************

tunnel-group 53.53.53.32 type ipsec-l2l
tunnel-group 53.53.53.32 general-attributes
 default-group-policy AmznGrpPolicy
tunnel-group 53.53.53.32 ipsec-attributes
 ikev1 pre-shared-key *******************
 isakmp keepalive threshold 10 retry 3
 ikev2 remote-authentication pre-shared-key *******************
 ikev2 local-authentication pre-shared-key *******************

!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 4096
  no tcp-inspection
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect rsh 
  inspect rtsp 
  inspect esmtp 
  inspect sqlnet 
  inspect skinny  
  inspect sunrpc 
  inspect xdmcp 
  inspect sip  
  inspect netbios 
  inspect tftp 
  inspect ip-options 
 class class-default
  user-statistics accounting
!
service-policy global_policy global

This is a very stripped down/sanitized config with all addresses/names changed and lots of unrelated VPN tunnels removed.

The current server that's NAT'd to the public-address is "webserver". The new server that I need to NAT to the same thing is "webserver-aws" (a server inside an AWS VPC that's connected to the ASA via the Site-Site VPN). I'm trying to set it up concurrently to test, so current server is exposing tcp443 as tcp443 and my test entry is trying to expose the new server on tcp8443 for testing.

Edit 2:

After trying @Ricky's answer with and without no-proxy-arp, this is my packet tracer result:

packet-tracer input outside tcp 0.0.0.1 1 109.1.2.27 8443 detailed gave this


Phase: 1
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
found next-hop 109.1.2.27 using egress ifc  outside

Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (nat-no-xlate-to-pat-pool) Connection to PAT address without pre-existing xlate
Improve this question
11
  • I'm trying to understand what you're asking. Are you saying you want a server physically at the branch office that's connected to the data center over a site-to-site tunnel to be NATed to a public IP address assigned to the data center? Like you want public internet requests to come in to the data center, to then go over the tunnel to reach the server?
    – Jesse P.
    Feb 21, 2021 at 17:17
  • We need to see the ASA configuration. Can the server reach the Internet ( outbound)?
    – Ron Trunk
    Feb 21, 2021 at 18:03
  • 1
    You not only need to DNAT the public address at the datacenter, you also need to make sure that the remote server's replies are going back into the VPN tunnel (e.g. using policy-based routing).
    – Zac67 ♦
    Feb 21, 2021 at 20:26
  • 1
    @JesseP. : Yes, that's exactly what I need. I have a single purpose server that's currently in the DataCenter that's exposed as a public IP (DataCenter owned). I have users of that server that require it to be accessed at that public IP address (due to firewall rules, which will take me a year to get changed, if I'm lucky). I need to relocate that server from behind the ASA at the DataCenter to the branch office. I can route all traffic from that server back through the Site-To-Site tunnel if needed. I control the branch office, site-to-site tunnel and the ASA in the datacenter.
    – Chris Holt
    Feb 21, 2021 at 22:58
  • 1
    @JesseP. Sanitized config posted.
    – Chris Holt
    Feb 22, 2021 at 5:22

1 Answer 1

Reset to default
2 
object network obj-SERVER
 host <SERVER>
!
object network obj_any
 subnet 0.0.0.0 0.0.0.0
!
object service dest-tcp-REAL
 service tcp destination eq <REAL> 
object service dest-tcp-MAPPED
 service tcp destination eq <MAPPED> 
!
nat (outside,inside) source static obj_any interface destination static interface obj-SERVER service dest-tcp-MAPPED dest-tcp-REAL unidirectional no-proxy-arp

That maps the outside interface address to an inside server, and changes the source to the inside interface so the traffic will return to the same firewall. If the outside IP isn't the firewall's interface, you'll need an additional host object to replace the first "interface" (source). Internal routing should handle it from there, but there may be some crazy required. (I have "nat 0" rules as well, but my vpn setup is not normal.)

This worked for me to map a serial console port through a backup link that would not otherwise be the return path for that traffic.

[ASA 9.1(7)32]

Improve this answer
17
  • That's exactly what they're asking; users must connect to that server public IP... If the remote site is not contained to the VPN, then this is what is needed. The server's default gateway (and associated kit) rarely send the return traffic back along the same path (asymmetric routing), so the original FW holding the NAT entry doesn't handle the replies. Correct the routing and simple NAT is all that's needed -- exactly the same as before the move, just with a different inside address. (the hairpin can be it's own issue.)
    – Ricky
    Feb 22, 2021 at 2:59
  • A sends to B who rewrites it to go to X. Any reply will be X to A; X doesn't know about B. If the X>A path doesn't flow back through B, X won't be rewritten back to B, and the whole thing falls apart. There are two ways to fix that: (1) fiddle with routing to make X>A go through B, or (2) rewrite A so the traffic looks like it came from B, and thus will always come back to B. Option 1 is policy-based routing; a slow, expensive process on most hardware, and an annoying surprise to the next admin. Option 2 is problem for security as the server no longer knows the true origin of the traffic.
    – Ricky
    Feb 22, 2021 at 3:12
  • Site-to-site VPN. Yes, I'm assuming the VPN works. The above changes src and dst, so the server sees the FW as the source, not the internet user. Thus, the reply will go back to the FW so long as the VPN works.
    – Ricky
    Feb 22, 2021 at 9:38
  • @Ricky, I've configured your suggestion with no luck thus far. And as you suggested, I replaced the first "interface" with a host object for the outside IP since the public IP is not the ASA's external interface. (it's the external IP +1 in this case). Any suggestions on ASA capture/debug commands to diagnose where it's failing?
    – Chris Holt
    Feb 22, 2021 at 15:23
  • 1
    I finally got this to work. With 1 addition. object network obj-fake-source host <unused-address-inside-asa> And 1 tweak. nat (outside,outside) source static obj_any obj-fake-source destination static interface obj-SERVER service dest-tcp-MAPPED dest-tcp-REAL unidirectional no-proxy-arp
    – Chris Holt
    Jun 2, 2021 at 19:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.