https://community.cisco.com/t5/network-security/twice-nat-configuration/m-p/2844335#M160127 <P>Hi,</P> <P></P> <P>Thanks for your answer! It could be a good solution, let me try it and come back with feedback.</P> <P></P> <P></P> <P></P> <P>&nbsp;</P> <P>&nbsp;</P> Mon, 01 Feb 2016 13:01:25 GMT ciscolunero 2016-02-01T13:01:25Z https://community.cisco.com/t5/network-security/twice-nat-configuration/m-p/2844333#M160106 <P style="text-autospace: none;">Hi,</P> <P style="text-autospace: none;">&nbsp;</P> <P style="text-autospace: none;">I have an issue with my CISCO ASA. I need to publish some ports to one server in my DMZ subnet (80, 555 and two range ports (TCP 20100-21999 and UDP 20100-21999) I dont know what I´m doing wrong with the range ports but NAT is not working. For 80 and 555 ports I have used Network Object NAT and it works perfectly. However, I cant do the same with the range ports, so I have to use 'standard NAT'&nbsp; rules, and its not working.&nbsp; I have even tried to remove network object nat rules and use&nbsp; 'standard NAT' for 80 and 555 tcp ports as well. But if do this, 80 and 555 stop working.</P> <P style="text-autospace: none;">&nbsp;</P> <P style="text-autospace: none;">Any clues?</P> <P style="text-autospace: none;">&nbsp;</P> <P style="text-autospace: none;">Many, many thanks in advance.</P> <P style="text-autospace: none;">&nbsp;</P> <P style="text-autospace: none;">: Serial Number: JAD19220344</P> <P style="text-autospace: none;">: Hardware: ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cores)</P> <P style="text-autospace: none;">:</P> <P style="text-autospace: none;">ASA Version 9.4(1)</P> <P style="text-autospace: none;">!</P> <P style="text-autospace: none;">hostname ciscoasa</P> <P style="text-autospace: none;">enable password WmlxhdtfAnw9XbcA encrypted</P> <P style="text-autospace: none;">passwd ta.qizy4R//ChqQH encrypted</P> <P style="text-autospace: none;">names</P> <P style="text-autospace: none;">ip local pool Pool_139 139.16.1.50-139.16.1.80 mask 255.255.255.0</P> <P style="text-autospace: none;">ip local pool Pool_172 172.16.1.100-172.16.1.130 mask 255.255.255.0</P> <P style="text-autospace: none;">!</P> <P style="text-autospace: none;">interface GigabitEthernet1/1</P> <P style="text-autospace: none;">nameif outside</P> <P style="text-autospace: none;">security-level 0</P> <P style="text-autospace: none;">ip address 192.168.1.100 255.255.255.0</P> <P style="text-autospace: none;">!</P> <P style="text-autospace: none;">interface GigabitEthernet1/2</P> <P style="text-autospace: none;">nameif inside</P> <P style="text-autospace: none;">security-level 100</P> <P style="text-autospace: none;">ip address 139.16.1.1 255.255.255.0</P> <P style="text-autospace: none;">!</P> <P style="text-autospace: none;">interface GigabitEthernet1/3</P> <P style="text-autospace: none;">nameif DMZ</P> <P style="text-autospace: none;">security-level 50</P> <P style="text-autospace: none;">ip address 172.16.1.1 255.255.255.0</P> <P style="text-autospace: none;">!</P> <P style="text-autospace: none;">interface GigabitEthernet1/4</P> <P style="text-autospace: none;">shutdown</P> <P style="text-autospace: none;">no nameif</P> <P style="text-autospace: none;">no security-level</P> <P style="text-autospace: none;">no ip address</P> <P style="text-autospace: none;">!</P> <P style="text-autospace: none;">interface GigabitEthernet1/5</P> <P style="text-autospace: none;">shutdown</P> <P style="text-autospace: none;">no nameif</P> <P style="text-autospace: none;">no security-level</P> <P style="text-autospace: none;">no ip address</P> <P style="text-autospace: none;">!</P> <P style="text-autospace: none;">interface GigabitEthernet1/6</P> <P style="text-autospace: none;">shutdown</P> <P style="text-autospace: none;">no nameif</P> <P style="text-autospace: none;">no security-level</P> <P style="text-autospace: none;">no ip address</P> <P style="text-autospace: none;">!</P> <P style="text-autospace: none;">interface GigabitEthernet1/7</P> <P style="text-autospace: none;">shutdown</P> <P style="text-autospace: none;">no nameif</P> <P style="text-autospace: none;">no security-level</P> <P style="text-autospace: none;">no ip address</P> <P style="text-autospace: none;">!</P> <P style="text-autospace: none;">interface GigabitEthernet1/8</P> <P style="text-autospace: none;">shutdown</P> <P style="text-autospace: none;">no nameif</P> <P style="text-autospace: none;">no security-level</P> <P style="text-autospace: none;">no ip address</P> <P style="text-autospace: none;">!</P> <P style="text-autospace: none;">interface Management1/1</P> <P style="text-autospace: none;">management-only</P> <P style="text-autospace: none;">nameif management</P> <P style="text-autospace: none;">security-level 100</P> <P style="text-autospace: none;">ip address 11.11.11.11 255.255.255.0</P> <P style="text-autospace: none;">!</P> <P style="text-autospace: none;">ftp mode passive</P> <P style="text-autospace: none;">clock timezone CEST 1</P> <P style="text-autospace: none;">clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00</P> <P style="text-autospace: none;">object network obj_any</P> <P style="text-autospace: none;">subnet 0.0.0.0 0.0.0.0</P> <P style="text-autospace: none;">object network inside-subnet</P> <P style="text-autospace: none;">subnet 139.16.1.0 255.255.255.0</P> <P style="text-autospace: none;">object network dmz-subnet</P> <P style="text-autospace: none;">subnet 172.16.1.0 255.255.255.0</P> <P style="text-autospace: none;">object network wialon-server-external-ip</P> <P style="text-autospace: none;">host 192.168.1.132</P> <P style="text-autospace: none;">object network wialon-server</P> <P style="text-autospace: none;">host 172.16.1.69</P> <P style="text-autospace: none;">object service Wialon-services-TCP</P> <P style="text-autospace: none;">service tcp source range 20100 21999 destination range 20100 21999</P> <P style="text-autospace: none;">object service Wialon-services-UDP</P> <P style="text-autospace: none;">service udp source range 20100 21999 destination range 20100 21999</P> <P style="text-autospace: none;">object network NETWORK_OBJ_139.16.1.0_25</P> <P style="text-autospace: none;">subnet 139.16.1.0 255.255.255.128</P> <P style="text-autospace: none;">object network wialon-server-ssl</P> <P style="text-autospace: none;">host 172.16.1.69</P> <P style="text-autospace: none;">object service wialon-ssl</P> <P style="text-autospace: none;">service tcp source range 1 65535 destination eq 555</P> <P style="text-autospace: none;">object-group service DM_INLINE_SERVICE_1</P> <P style="text-autospace: none;">service-object tcp destination eq www</P> <P style="text-autospace: none;">service-object udp destination eq domain</P> <P style="text-autospace: none;">service-object tcp destination eq https</P> <P style="text-autospace: none;">access-list outside_acl extended permit tcp any object wialon-server eq www</P> <P style="text-autospace: none;">access-list outside_acl extended permit object Wialon-services-TCP any object wialon-server</P> <P style="text-autospace: none;">access-list outside_acl extended permit object Wialon-services-UDP any object wialon-server</P> <P style="text-autospace: none;">access-list outside_acl extended permit object wialon-ssl any object wialon-server</P> <P style="text-autospace: none;">access-list DMZ_access_in extended permit ip object wialon-server 139.16.1.0 255.255.255.0</P> <P style="text-autospace: none;">access-list DMZ_access_in extended permit object-group DM_INLINE_SERVICE_1 any any</P> <P style="text-autospace: none;">pager lines 24</P> <P style="text-autospace: none;">logging asdm informational</P> <P style="text-autospace: none;">mtu outside 1500</P> <P style="text-autospace: none;">mtu inside 1500</P> <P style="text-autospace: none;">mtu DMZ 1500</P> <P style="text-autospace: none;">mtu management 1500</P> <P style="text-autospace: none;">icmp unreachable rate-limit 1 burst-size 1</P> <P style="text-autospace: none;">no asdm history enable</P> <P style="text-autospace: none;">arp timeout 14400</P> <P style="text-autospace: none;">no arp permit-nonconnected</P> <P style="text-autospace: none;">nat (DMZ,outside) source static any any destination static NETWORK_OBJ_139.16.1.0_25 NETWORK_OBJ_139.16.1.0_25 route-lookup</P> <P style="text-autospace: none;">nat (DMZ,outside) source static wialon-server wialon-server-external-ip service Wialon-services-TCP Wialon-services-TCP</P> <P style="text-autospace: none;">!</P> <P style="text-autospace: none;">object network obj_any</P> <P style="text-autospace: none;">nat (any,outside) dynamic interface</P> <P style="text-autospace: none;">object network inside-subnet</P> <P style="text-autospace: none;">nat (inside,outside) dynamic interface</P> <P style="text-autospace: none;">object network wialon-server</P> <P style="text-autospace: none;">nat (DMZ,outside) static wialon-server-external-ip service tcp www www</P> <P style="text-autospace: none;">object network wialon-server-ssl</P> <P style="text-autospace: none;">nat (DMZ,outside) static wialon-server-external-ip service tcp 555 555</P> <P style="text-autospace: none;">access-group outside_acl in interface outside</P> <P style="text-autospace: none;">access-group DMZ_access_in in interface DMZ</P> <P style="text-autospace: none;">route outside 0.0.0.0 0.0.0.0 192.168.1.1 1</P> <P style="text-autospace: none;">timeout xlate 3:00:00</P> <P style="text-autospace: none;">timeout pat-xlate 0:00:30</P> <P style="text-autospace: none;">timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02</P> <P style="text-autospace: none;">timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00</P> <P style="text-autospace: none;">timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00</P> <P style="text-autospace: none;">timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute</P> <P style="text-autospace: none;">timeout tcp-proxy-reassembly 0:01:00</P> <P style="text-autospace: none;">timeout floating-conn 0:00:00</P> <P style="text-autospace: none;">user-identity default-domain LOCAL</P> <P style="text-autospace: none;">http server enable</P> <P style="text-autospace: none;">http 11.11.11.0 255.255.255.0 management</P> <P style="text-autospace: none;">http 139.16.1.0 255.255.255.0 inside</P> <P style="text-autospace: none;">no snmp-server location</P> <P style="text-autospace: none;">no snmp-server contact</P> <P style="text-autospace: none;">service sw-reset-button</P> <P style="text-autospace: none;">crypto ipsec ikev2 ipsec-proposal DES</P> <P style="text-autospace: none;">protocol esp encryption des</P> <P style="text-autospace: none;">protocol esp integrity sha-1 md5</P> <P style="text-autospace: none;">crypto ipsec ikev2 ipsec-proposal 3DES</P> <P style="text-autospace: none;">protocol esp encryption 3des</P> <P style="text-autospace: none;">protocol esp integrity sha-1 md5</P> <P style="text-autospace: none;">crypto ipsec ikev2 ipsec-proposal AES</P> <P style="text-autospace: none;">protocol esp encryption aes</P> <P style="text-autospace: none;">protocol esp integrity sha-1 md5</P> <P style="text-autospace: none;">crypto ipsec ikev2 ipsec-proposal AES192</P> <P style="text-autospace: none;">protocol esp encryption aes-192</P> <P style="text-autospace: none;">protocol esp integrity sha-1 md5</P> <P style="text-autospace: none;">crypto ipsec ikev2 ipsec-proposal AES256</P> <P style="text-autospace: none;">protocol esp encryption aes-256</P> <P style="text-autospace: none;">protocol esp integrity sha-1 md5</P> <P style="text-autospace: none;">crypto ipsec security-association pmtu-aging infinite</P> <P style="text-autospace: none;">crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES</P> <P style="text-autospace: none;">crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP</P> <P style="text-autospace: none;">crypto map outside_map interface outside</P> <P style="text-autospace: none;">crypto ca trustpoint ASDM_TrustPoint0</P> <P style="text-autospace: none;">enrollment self</P> <P style="text-autospace: none;">fqdn ciscoasa.xxxxxx.null</P> <P style="text-autospace: none;">email xxxx@gmail.com</P> <P style="text-autospace: none;">subject-name CN=xxxxxx</P> <P style="text-autospace: none;">serial-number</P> <P style="text-autospace: none;">proxy-ldc-issuer</P> <P style="text-autospace: none;">crl configure</P> <P style="text-autospace: none;">crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_0</P> <P style="text-autospace: none;">enrollment self</P> <P style="text-autospace: none;">fqdn none</P> <P style="text-autospace: none;">subject-name CN=139.16.1.1,CN=ciscoasa</P> <P style="text-autospace: none;">keypair ASDM_LAUNCHER</P> <P style="text-autospace: none;">crl configure</P> <P style="text-autospace: none;">crypto ca trustpool policy</P> <P style="text-autospace: none;">crypto ca certificate chain ASDM_TrustPoint0</P> <P style="text-autospace: none;">certificate 09836256</P> <P style="text-autospace: none;">30820381 30820269 a0030201 02020409 83625630 0d06092a 864886f7 0d010105</P> <P style="text-autospace: none;">05003050 31123010 06035504 03130973 72646f6e 6761746f 313a3012 06035504</P> <P style="text-autospace: none;">05130b4a 41443139 32323033 34343024 06092a86 4886f70d 01090216 17636973</P> <P style="text-autospace: none;">636f6173 612e7372 646f6e67 61746f2e 6e756c6c 301e170d 31353132 30353036</P> <P style="text-autospace: none;">33333535 5a170d32 35313230 32303633 3335355a 30503112 30100603 55040313</P> <P style="text-autospace: none;">09737264 6f6e6761 746f313a 30120603 55040513 0b4a4144 31393232 30333434</P> <P style="text-autospace: none;">30240609 2a864886 f70d0109 02161763 6973636f 6173612e 7372646f 6e676174</P> <P style="text-autospace: none;">6f2e6e75 6c6c3082 0122300d 06092a86 4886f70d 01010105 00038201 0f003082</P> <P style="text-autospace: none;">010a0282 010100d2 295e679c 153e8b6a d3f6131d 8ea646e3 aa0a5fa9 20e49259</P> <P style="text-autospace: none;">ca895563 7e818047 033a4e8f 57f619e9 fa93bfd5 6c44141f b0abf2c0 8b86334e</P> <P style="text-autospace: none;">bac63f41 99e6d676 c689dcf7 080f2715 038a8e1b 694a00de 7124565e a1948f09</P> <P style="text-autospace: none;">8dbeffab c7c8a028 741c5b10 d0ede5e9 599f38fe 5b88f678 4decdc4b 353b6708</P> <P style="text-autospace: none;">cfa2fbce f58be06e 18feba56 4b2b04a1 77773ec6 5c58d2ed d7ca4f17 980f0353</P> <P style="text-autospace: none;">138bfe65 1b1165e6 7b6f94bb ab4d4286 e900178c 147a6dba 2427f38e e225030f</P> <P style="text-autospace: none;">0a66d1eb 5075c57e 6d77e5bb 247f5bc3 8d3530f0 49dedf2d 21a24b5f daa08d98</P> <P style="text-autospace: none;">690183cf e82a6b8d 5e489956 c5eecdbc 7fc2365c b629a52b 126b51e2 18590ed5</P> <P style="text-autospace: none;">c9da8503 a639f102 03010001 a3633061 300f0603 551d1301 01ff0405 30030101</P> <P style="text-autospace: none;">ff300e06 03551d0f 0101ff04 04030201 86301f06 03551d23 04183016 80143468</P> <P style="text-autospace: none;">dec79103 0a91b530 1ada7e47 7e27b16d 4186301d 0603551d 0e041604 143468de</P> <P style="text-autospace: none;">c791030a 91b5301a da7e477e 27b16d41 86300d06 092a8648 86f70d01 01050500</P> <P style="text-autospace: none;">03820101 003cdb04 8ef5ed31 c05c684b ad2b0062 96bfd39a ecb0a3fe 547aebe5</P> <P style="text-autospace: none;">14b753e7 89f55827 3d4e0aa8 b8674e45 80d4c023 8e99a7b4 0907d347 060a2fe4</P> <P style="text-autospace: none;">fa6e0c2f 3b9cd708 a539c09f 7022d2ee fb6e2cf6 82b0e861 a2839a71 1512b3ec</P> <P style="text-autospace: none;">e28664e9 732270c9 d1c679d9 1eaf2ad5 007b5699 31c3ff97 09aae869 88677a3d</P> <P style="text-autospace: none;">ecb3032e 2dd0f74f 81f9a8fb 79f30809 723bbdbf dfef4154 5ad6b012 a8f37093</P> <P style="text-autospace: none;">481fa678 23390036 b44b0290 042828f3 5eefdc43 78934455 ebe52d26 9b4234a9</P> <P style="text-autospace: none;">bfeebc43 731c4146 166e5adc b431f12f 8d0fbf16 46306228 34d76984 d2e6ebbc</P> <P style="text-autospace: none;">96838694 88ca120a d4f32884 963e7385 987ec6b0 dfa28d49 05ba5fa8 641bcfc7</P> <P style="text-autospace: none;">ff92ac3c 52</P> <P style="text-autospace: none;">quit</P> <P style="text-autospace: none;">crypto ca certificate chain ASDM_Launcher_Access_TrustPoint_0</P> <P style="text-autospace: none;">certificate 0a836256</P> <P style="text-autospace: none;">308202cc 308201b4 a0030201 0202040a 83625630 0d06092a 864886f7 0d010105</P> <P style="text-autospace: none;">05003028 3111300f 06035504 03130863 6973636f 61736131 13301106 03550403</P> <P style="text-autospace: none;">130a3133 392e3136 2e312e31 301e170d 31353132 30353036 35363236 5a170d32</P> <P style="text-autospace: none;">35313230 32303635 3632365a 30283111 300f0603 55040313 08636973 636f6173</P> <P style="text-autospace: none;">61311330 11060355 0403130a 3133392e 31362e31 2e313082 0122300d 06092a86</P> <P style="text-autospace: none;">4886f70d 01010105 00038201 0f003082 010a0282 010100e7 a5c16e86 16c15a10</P> <P style="text-autospace: none;">e018b868 bac7271a 30f1a3f8 ecb9c6b8 3ed4b1ad c9468f5e 287f2a7a 644f1496</P> <P style="text-autospace: none;">c43a061e da927d09 a755b53e ed7c6a66 f2f1fb1e f944345c 86e08ce0 891c99b3</P> <P style="text-autospace: none;">13101ab3 04963fad f91f987f 99f22a89 cd1e8c5a 5e4c026d 2cadd7b7 6620bbd1</P> <P style="text-autospace: none;">b4a5135b 24ec886f fa061a06 dd536e96 1e483730 756c4101 23f83a8d 944a7fbe</P> <P style="text-autospace: none;">93c51d56 32ac0d17 ceb75f63 0ae24f07 f2c54e83 5b84ff00 16b0b899 c925c737</P> <P style="text-autospace: none;">1765b066 23b54645 bc419684 d09dd130 c1479949 68b0a779 df39b078 6fb0deb9</P> <P style="text-autospace: none;">758b14c3 f0801faf f0ad60e1 a018ffba d769f867 3fe8e5fc 88ccc5b2 2319f5d4</P> <P style="text-autospace: none;">617a78c4 74e7a64b 5c68276c 06ea57c1 d0ffce4b 358c4d02 03010001 300d0609</P> <P style="text-autospace: none;">2a864886 f70d0101 05050003 82010100 dff97c9f 4256fd47 8eb661fd d22ecea4</P> <P style="text-autospace: none;">589eff09 958e01f1 a435a20e 5ed1cf19 af42e54d d61fc0ab cb2ee7ac 7fcb4513</P> <P style="text-autospace: none;">1a44cc86 1e020d72 3a3f78d2 4d225177 857093d9 f5fcf3c7 6e656d2b 54a0c522</P> <P style="text-autospace: none;">f636b8cf 33c5ae34 ea340f32 85dff4c1 50165e7a e94de10b ced15752 0b3a76c1</P> <P style="text-autospace: none;">20291106 2a50777b a1a8a214 8a003716 680c15d4 ac3f7cc7 378f8f5f 38e3403f</P> <P style="text-autospace: none;">f958c095 e549c8ed 4baf8cc5 bdcd230e 260754ea 953c3a4c eb01fef5 62b97e01</P> <P style="text-autospace: none;">9f82ce6b f479dbdd 000c45af 8758b35f b4a958ee 32c4db3f 2ddc7385 dc05b0e3</P> <P style="text-autospace: none;">78b609ba a9280841 2433ae87 5dd7a7c2 d5691068 1dc0eddc c23f99c5 3df8b1a5</P> <P style="text-autospace: none;">aadbd82a 423f4ba8 563142bf 742771c3</P> <P style="text-autospace: none;">quit</P> <P style="text-autospace: none;">crypto ikev2 policy 1</P> <P style="text-autospace: none;">encryption aes-256</P> <P style="text-autospace: none;">integrity sha</P> <P style="text-autospace: none;">group 5 2</P> <P style="text-autospace: none;">prf sha</P> <P style="text-autospace: none;">lifetime seconds 86400</P> <P style="text-autospace: none;">crypto ikev2 policy 10</P> <P style="text-autospace: none;">encryption aes-192</P> <P style="text-autospace: none;">integrity sha</P> <P style="text-autospace: none;">group 5 2</P> <P style="text-autospace: none;">prf sha</P> <P style="text-autospace: none;">lifetime seconds 86400</P> <P style="text-autospace: none;">crypto ikev2 policy 20</P> <P style="text-autospace: none;">encryption aes</P> <P style="text-autospace: none;">integrity sha</P> <P style="text-autospace: none;">group 5 2</P> <P style="text-autospace: none;">prf sha</P> <P style="text-autospace: none;">lifetime seconds 86400</P> <P style="text-autospace: none;">crypto ikev2 policy 30</P> <P style="text-autospace: none;">encryption 3des</P> <P style="text-autospace: none;">integrity sha</P> <P style="text-autospace: none;">group 5 2</P> <P style="text-autospace: none;">prf sha</P> <P style="text-autospace: none;">lifetime seconds 86400</P> <P style="text-autospace: none;">crypto ikev2 policy 40</P> <P style="text-autospace: none;">encryption des</P> <P style="text-autospace: none;">integrity sha</P> <P style="text-autospace: none;">group 5 2</P> <P style="text-autospace: none;">prf sha</P> <P style="text-autospace: none;">lifetime seconds 86400</P> <P style="text-autospace: none;">crypto ikev2 enable outside client-services port 443</P> <P style="text-autospace: none;">crypto ikev2 remote-access trustpoint ASDM_TrustPoint0</P> <P style="text-autospace: none;">telnet 139.16.1.0 255.255.255.0 inside</P> <P style="text-autospace: none;">telnet 11.11.11.0 255.255.255.0 management</P> <P style="text-autospace: none;">telnet timeout 5</P> <P style="text-autospace: none;">no ssh stricthostkeycheck</P> <P style="text-autospace: none;">ssh timeout 5</P> <P style="text-autospace: none;">ssh key-exchange group dh-group1-sha1</P> <P style="text-autospace: none;">console timeout 0</P> <P style="text-autospace: none;">dhcpd auto_config outside</P> <P style="text-autospace: none;">!</P> <P style="text-autospace: none;">dhcpd address 172.16.1.69-172.16.1.69 DMZ</P> <P style="text-autospace: none;">dhcpd dns 87.216.1.65 87.216.1.66 interface DMZ</P> <P style="text-autospace: none;">dhcpd option 3 ip 172.16.1.1 interface DMZ</P> <P style="text-autospace: none;">dhcpd enable DMZ</P> <P style="text-autospace: none;">!</P> <P style="text-autospace: none;">threat-detection basic-threat</P> <P style="text-autospace: none;">threat-detection statistics access-list</P> <P style="text-autospace: none;">no threat-detection statistics tcp-intercept</P> <P style="text-autospace: none;">ssl trust-point ASDM_Launcher_Access_TrustPoint_0 outside</P> <P style="text-autospace: none;">ssl trust-point ASDM_Launcher_Access_TrustPoint_0 inside</P> <P style="text-autospace: none;">ssl trust-point ASDM_Launcher_Access_TrustPoint_0 inside vpnlb-ip</P> <P style="text-autospace: none;">webvpn</P> <P style="text-autospace: none;">enable outside</P> <P style="text-autospace: none;">enable inside</P> <P style="text-autospace: none;">enable DMZ</P> <P style="text-autospace: none;">anyconnect image disk0:/anyconnect-win-3.1.12020-k9.pkg 1</P> <P style="text-autospace: none;">anyconnect profiles Wialon_client_profile disk0:/Wialon_client_profile.xml</P> <P style="text-autospace: none;">anyconnect enable</P> <P style="text-autospace: none;">tunnel-group-list enable</P> <P style="text-autospace: none;">error-recovery disable</P> <P style="text-autospace: none;">group-policy GroupPolicy_Wialon internal</P> <P style="text-autospace: none;">group-policy GroupPolicy_Wialon attributes</P> <P style="text-autospace: none;">wins-server none</P> <P style="text-autospace: none;">dns-server value 192.168.1.1</P> <P style="text-autospace: none;">vpn-tunnel-protocol ikev2 ssl-client ssl-clientless</P> <P style="text-autospace: none;">default-domain none</P> <P style="text-autospace: none;">webvpn</P> <P style="text-autospace: none;">anyconnect profiles value Wialon_client_profile type user</P> <P style="text-autospace: none;">dynamic-access-policy-record DfltAccessPolicy</P> <P style="text-autospace: none;">username wialon_1 password Wy2aFpAQTXQavfJD encrypted</P> <P style="text-autospace: none;">&nbsp;</P> <P style="text-autospace: none;">service-type remote-access</P> <P style="text-autospace: none;">tunnel-group Wialon type remote-access</P> <P style="text-autospace: none;">tunnel-group Wialon general-attributes</P> <P style="text-autospace: none;">address-pool Pool_139</P> <P style="text-autospace: none;">default-group-policy GroupPolicy_Wialon</P> <P style="text-autospace: none;">tunnel-group Wialon webvpn-attributes</P> <P style="text-autospace: none;">group-alias Wialon enable</P> <P style="text-autospace: none;">!</P> <P style="text-autospace: none;">class-map inspection_default</P> <P style="text-autospace: none;">match default-inspection-traffic</P> <P style="text-autospace: none;">!</P> <P style="text-autospace: none;">!</P> <P style="text-autospace: none;">policy-map type inspect dns preset_dns_map</P> <P style="text-autospace: none;">parameters</P> <P style="text-autospace: none;">message-length maximum client auto</P> <P style="text-autospace: none;">message-length maximum 512</P> <P style="text-autospace: none;">policy-map global_policy</P> <P style="text-autospace: none;">class inspection_default</P> <P style="text-autospace: none;">inspect dns preset_dns_map</P> <P style="text-autospace: none;">inspect ftp</P> <P style="text-autospace: none;">inspect h323 h225</P> <P style="text-autospace: none;">inspect h323 ras</P> <P style="text-autospace: none;">inspect rsh</P> <P style="text-autospace: none;">inspect rtsp</P> <P style="text-autospace: none;">inspect esmtp</P> <P style="text-autospace: none;">inspect sqlnet</P> <P style="text-autospace: none;">inspect skinny</P> <P style="text-autospace: none;">inspect sunrpc</P> <P style="text-autospace: none;">inspect xdmcp</P> <P style="text-autospace: none;">inspect sip</P> <P style="text-autospace: none;">inspect netbios</P> <P style="text-autospace: none;">inspect tftp</P> <P style="text-autospace: none;">inspect ip-options</P> <P style="text-autospace: none;">!</P> <P style="text-autospace: none;">service-policy global_policy global</P> <P style="text-autospace: none;">prompt hostname context</P> <P style="text-autospace: none;">no call-home reporting anonymous</P> <P style="text-autospace: none;">Cryptochecksum:0cc4df99103b3939601f2604ddda8585</P> <P style="text-autospace: none;">: end</P> Tue, 12 Mar 2019 07:13:20 GMT https://community.cisco.com/t5/network-security/twice-nat-configuration/m-p/2844333#M160106 ciscolunero 2019-03-12T07:13:20Z https://community.cisco.com/t5/network-security/twice-nat-configuration/m-p/2844334#M160115 <P>Could you not just do a 1:1 NAT and use the access-list to control what ports are allowed in?</P> <P></P> <P>Something more like:</P> <PRE class="prettyprint">object network wialon-server<BR />&nbsp; nat (DMZ,outside) static wialon-server-external-ip</PRE> Mon, 01 Feb 2016 10:40:55 GMT https://community.cisco.com/t5/network-security/twice-nat-configuration/m-p/2844334#M160115 Philip D'Ath 2016-02-01T10:40:55Z https://community.cisco.com/t5/network-security/twice-nat-configuration/m-p/2844335#M160127 <P>Hi,</P> <P></P> <P>Thanks for your answer! It could be a good solution, let me try it and come back with feedback.</P> <P></P> <P></P> <P></P> <P>&nbsp;</P> <P>&nbsp;</P> Mon, 01 Feb 2016 13:01:25 GMT https://community.cisco.com/t5/network-security/twice-nat-configuration/m-p/2844335#M160127 ciscolunero 2016-02-01T13:01:25Z https://community.cisco.com/t5/network-security/twice-nat-configuration/m-p/2844336#M160134 <P>It works! Many Thanks!! &nbsp;</P> Mon, 01 Feb 2016 22:21:46 GMT https://community.cisco.com/t5/network-security/twice-nat-configuration/m-p/2844336#M160134 ciscolunero 2016-02-01T22:21:46Z