topic Yes, from the local network I in Network Security

NAT on a stick disabling ssh

gpettydpmg — Tue, 12 Mar 2019 08:29:54 GMT

I've got a standard single interface router hosting a number of ipsec tunnels. I'm attempting to add a loopback interface and enable nat outside on the physical interface. The second I enable ip nat outside I lose ssh and telnet access from both inside and outside. This being a azure csr router I have no console access to it and have to reboot it each time to get it back.

Is there some reason nat outside is blocking access? I intend on using route maps to nat some specific tunnel traffic but simply enabling nat kicks me off entirely.

interface Loopback1
ip address 11.1.1.1 255.255.255.255
ip nat inside

!
interface FastEthernet0/0
ip address 172.31.3.4 255.255.255.0
ip nat outside
duplex auto
speed auto
crypto map clientvpn
!

ip nat inside source list NAT interface FastEthernet0/0 overload

!
ip access-list extended NAT

permit ip 172.31.0.0 0.0.255.255 any

what IP address are you

Dennis Mink — Sun, 06 Nov 2016 23:01:44 GMT

what IP address are you connecting to when ssh-ing into the machine? 172.31.3.4?

Yes, from the local network I

gpettydpmg — Sun, 06 Nov 2016 23:43:10 GMT

Yes, from the local network I can still ping the interface after enabling nat outside on it but ports 22/23 instantly close

Ok I think I figured out what

gpettydpmg — Mon, 07 Nov 2016 17:39:52 GMT

Ok I think I figured out what I was missing. I expected because i was on the local network I would still have access to those ports but becaues I've enabled nat outside on it, it blocks incoming traffic. I can actually access ssh/telnet on the loopback ip if I'm routed to the F0/0 interface.

All I needed was to open the port with a static map

ip nat inside source static tcp 11.1.1.1 23 int f0/0 23

That opened telnet back up, silly oversight on my part.

You may have to enable SSH on

James Leinweber — Mon, 07 Nov 2016 18:02:02 GMT

You may have to enable SSH on an additional, non-default port. In my experience ASA firmwares don't handle direct access to addresses+ports with NAT mappings in the way you might expect. If you keep the NAT mapping and the local access separate, they will probably both work simultaneously. Otherwise, not.

-- Jim Leinweber, WI State Lab of Hygiene