topic Firewall NAT in Network Security

Firewall NAT

pablo.arcelcr — Fri, 21 Feb 2020 14:14:28 GMT

I need to allow to connect to a internet web server using a public IP address. I added this to my ASA 5520.

object network Polycom-10.154.10.5
host 10.154.10.5

object network Polycom-10.154.10.5
nat (inside,outside) static 201.201.134.151

access-list Outside_Polycom_in extended permit tcp any object Polycom-10.154.10.5 eq 80

access-list Outside_Polycom_in extended permit tcp any object Polycom-10.154.10.5 eq 443

access-group Outside_Polycom_in in interface Outside

I try to access it using the public IP address, but still not connecting.

Francesco Molino — Fri, 25 Aug 2017 00:50:03 GMT

Do you see something on logs?

Can you run three following command and paste the output in a text file?

Packet-tracer input outside tcp 8.8.8.8 12345 201.201.134.151 80 detail

Thanks

PS: please don't forget to rate helpful answers and select add correct answer if that solves your issue

James Davies — Fri, 25 Aug 2017 09:16:22 GMT

If this is 8.3 Version or later, Im pretty sure your access list need to be the Public IP.

access-list Outside_Polycom_in extended permit tcp any object Polycom-201.201.134.151 eq 80

access-list Outside_Polycom_in extended permit tcp any object Polycom-201.201.134.151 eq 443

Thanks

pablo.arcelcr — Mon, 28 Aug 2017 23:26:23 GMT

Please check attached

Francesco Molino — Tue, 29 Aug 2017 00:15:00 GMT

It seems to be OK from outside.

Can you do a test internally from you lan, try to telnet the internal IP using the port 80 to see if you get an answer.

Are you sure the service http or https is activated on your machine?

Thanks

PS: Please don't forget to rate and select as validated answer if this answered your question

pablo.arcelcr — Tue, 29 Aug 2017 00:56:37 GMT

It works just fine. The problema is with the External IP Im using for the NAT

Francesco Molino — Tue, 29 Aug 2017 01:00:31 GMT

Can you send your full config?

Thanks

Francesco Molino — Tue, 29 Aug 2017 01:03:34 GMT

Does that means it's working now?
If not send also some fw logs when attempting an access to that server from outside.
Thanks