topic Thanks for your answer in Network Security

ASA 5540 Management interface internet access problem

gasparmenendez — Tue, 12 Mar 2019 08:32:09 GMT

Hello friends,

this time I have a problem with my ASA 5540. It has configured an outside interface and 3 inside interfaces. The outside interface has a public IP address and is Nating everything from inside interfaces. So far so good. My problem is that I just connect a Cable Modem to the Managemement interface and I'm trying to redirect some traffic from one of the inside interfaces through the CM. The CM has a public IP on its WAN and a private IP on its LAN (192.168.1.1). I think I need to make a NAT rule like this:

nat (CABLE,CableModem) source dynamic net10.13.0.0-16 CM

also I have:

interface Management0/0
speed 100
duplex full
nameif CableModem
security-level 30
ip address 192.168.1.2 255.255.255.0

=============================================

object network obj-10.13.0.0
subnet 10.13.0.0 255.255.0.0

=============================================

object network CM
host 192.168.1.4

I don't know what I'm missing here. I've been trying for several days and several solutions but there's no possible way for me to do this. Can anybody helpme please??? At this point I'm very desperate. If something else is need it please let me know. Thank you very much in advance.

BR.

The first important thing to

Karsten Iwen — Mon, 14 Nov 2016 19:52:51 GMT

The first important thing to consider is, that the legacy 5540 can't do Policy-Based-Routing. You have to control with static routes which destinations should be reached through this line.

You need a static route with higher AD pointing to the CM next-hop.

For NAT, I wouldn't NAT on the ASA. Better configure a static route for the internal networks on the cable-modem and use the NAT/PAT that is done there.

Thanks for your answer

gasparmenendez — Mon, 14 Nov 2016 21:17:10 GMT

Thanks for your answer Karsten. Maybe I didn't make my self clear. Sorry for that and sorry for my English.

Network 10.13.0.0/16 is for CMTS with almost 1000 clients, so I need to do NAT on ASA. Right now I have that network accesing to internet just fine, but through a public IP (200.X.X.152) in the outside interface:

nat (CABLE,outside) source dynamic net10.13.0.0-16 ip152

What I need is that CMTS (10.13.0.0/16) reach the internet through the Management interface with the other ISP (Cable Modem) connected to it. I thought it was so simple as change the interface and the NAT ip but obviously I'm wrong.

I don't know what I'm doing wrong. Any ideas???

BR.

ok, so the new exitpoint is

Karsten Iwen — Mon, 14 Nov 2016 22:29:53 GMT

ok, so the new exitpoint is the interface "CableModem"? Then add the default-route to the modem, remove the old route and configure the NAT as you have done above. Make sure to put the NAT-rule at the end by specifying the keyword "after-auto":

nat (CABLE,CableModem) after-auto source dynamic net10.13.0.0-16 CM

Also make sure that there are no conflicting rules above.

Didn't work. I'm seeing no

gasparmenendez — Mon, 14 Nov 2016 23:35:20 GMT

Didn't work. I'm seeing no traffic on CableModem interface.

what I don't understand is why when I set up a static ip to my lap (192.168.1.4) and connect it directly to CM I can reach the internet, but when I connect the CM to the ASA interface (192.168.1.2) and set that very same ip address (192.168.1.4) for NAT it doesn't work...

This thing is driving me crazy!!

I think I don't need to modify routes in the CM since the ASA is translating network 10.13.0.0/16 in 192.168.1.4, right???

can you share the rest of

Karsten Iwen — Tue, 15 Nov 2016 21:39:20 GMT

can you share the rest of your NAT- and routing-config?

No more ideas???

gasparmenendez — Tue, 15 Nov 2016 21:44:50 GMT

would you like something specific?? coz the ASA has a big big configuration....it's nearly impossible copy it here. BR.

At least it's very likely

Karsten Iwen — Wed, 16 Nov 2016 15:16:50 GMT

At least it's very likely that the problem is NAT- or routing related.

Or after configuring it in a way that you think it should work, you can run the packet-tracer

packet-tracer input CABLE tcp ANY-ALLOWED-INTERNAL-IP 1234 1.2.3.4 80

and share the result.

Nothing?? no more ideas???

gasparmenendez — Wed, 16 Nov 2016 16:47:28 GMT

this is the result:

PIX-COSMOCABLE# packet-tracer input CABLE tcp ANY-ALLOWED-INTERNAL-IP 1234 1.2$

packet-tracer input CABLE tcp ANY-ALLOWED-INTERNAL-IP 1234 1.2.3.4 80
^
ERROR: % Invalid input detected at '^' marker.

it seems to be an error on the ANY-ALLOWED-INTERNAL-IP.

But I'm thinking, the CABLE interface works fine when the NAT is throuhg OUTSIDE interface. The problem is when the NAT is through CABLEMODEM interface