topic Did you create a rule (on the in Network Security

ASA 8.2 static nat problem?

M.alzubaidy — Tue, 12 Mar 2019 07:03:49 GMT

Hi all

I have two active and standby ASA 5520 V(8.2) when I trying to configure static NAT by

static (inside,outside) interface 172.16.1.156

it work properly, but when I use this command instead of first one

static (inside,outside) 212.126.122.45 172.16.1.156

it dose not work!! and I need it to use another public IP for another private server because I have many servers inside each server need public ip, so any suggestion please??

note :

1- my inside network (172.16.0.0/16) and outside (212.126.122.40/29)

2- attachment conftain show run for both my ASA

many thanks..

Did you create a rule (on the

Philip D'Ath — Mon, 21 Dec 2015 19:10:09 GMT

Did you create a rule (on the outside interface) allowing traffic into 212.126.122.45?

many thanks for replying, yes

M.alzubaidy — Mon, 21 Dec 2015 19:28:28 GMT

many thanks for replying, yes I create that

access-list outside_access_in extended permit ip any any
access-list inside_access_in extended permit ip any any

access-group inside_access_in in interface inside
access-group outside_access_in in interface outside

I don't think you have

Philip D'Ath — Mon, 21 Dec 2015 19:35:34 GMT

I don't think you have anything wrong. Try the change again, and then maybe something like:

clear xlate

Also try waiting 10 minutes. It smells like something has cached something.

If you do a "show arp | inc 212.126.122.45" it definitely comes back with nothing (meaning that the IP address is not in use), correct?

Hi,

Shivapramod M — Tue, 22 Dec 2015 04:58:39 GMT

Hi,

First you can try to take the packet tracer on the ASA to check whether the ASA is allowing the traffic or not.

packet-tracer input outside tcp <source IP> 12345 212.126.122.45 80 detail

If you do not see any error in this then you can take the capture on the outside and inside interface of the firewall to check whether traffic is passing through the firewall or not. This needs the actual traffic to test.

cap capin interface outside match tcp host <internet IP> host 212.126.122.45 eq 80
cap capout interface inside match tcp host <internet IP> host 172.16.1.156 eq 80

to view the capture output:

show cap capin

show cap capout

Thanks,
Shivapramod M
Please remember to select a correct answer and rate helpful posts