topic Thank for your reply.That in Network Security

ASA - NAT issue

Arthur DENIS — Tue, 12 Mar 2019 05:38:32 GMT

Hello,

I try to configure my ASA firewall to redirect http port from outside (outside-OVH) to inside (vlan1).

Please find here the following configuration:

object network NAT-SERVEUR-HTTP-IN
 nat (VLAN1,outside-OVH) static interface service tcp www www

access-list outside-OVH_access_in extended permit tcp any4 object-group DM_INLINE_NETWORK_1 eq www

object-group network DM_INLINE_NETWORK_1
 network-object object NAT-SERVEUR-HTTP-IN
 network-object object SRV-SERVEUR

object network NAT-SERVEUR-HTTP-IN
 host 192.168.1.2

However, I get this logs from ASDM:

Mar 14 2015

16:06:12

710003

80.12.35.21

52108

109.190.13.144

TCP access denied by ACL from 80.12.35.21/52108 to outside-OVH:109.190.13.144/80

Can you please help me about it?

Thank you for advance,

Best regards

Hi. Can you please provide

Andre Neethling — Sat, 14 Mar 2015 18:01:54 GMT

Hi. Can you please provide all your NAT statements......... or your entire running config. That will make it easier to troubleshoot.

Can you post the output of -

Jon Marshall — Sat, 14 Mar 2015 18:03:28 GMT

Can you post the output of -

"packet-tracer input outside tcp 8.8.8.8 12345 <public IP of web server> 80"

and

"sh nat"

and also your ASA configuration.

Jon

Hi,Please find in attached

Arthur DENIS — Sat, 14 Mar 2015 18:57:04 GMT

Hi,

Please find in attached the "sh nat" and the "sh run" result.

I don't get nothing from packet-capture...

I don't understand.Your NAT

Jon Marshall — Sat, 14 Mar 2015 19:04:37 GMT

I don't understand.

Your NAT output and your running config does not show the static statements in your original post ?

Did you remove them ?

Anyway, put them back in and change this statement -

nat (VLAN1,outside-OVH) source dynamic NET-VLAN1 interface

to be

nat (VLAN1,outside-OVH) after-auto source dynamic NET-VLAN1 interface

and try again.

Jon

Thank for your reply.That

Arthur DENIS — Sat, 14 Mar 2015 19:13:32 GMT

Thank for your reply.

That didn't work anyway. Please find the new sh run in attached.

I get the same error:

Mar 14 2015

20:13:10

710003

80.12.35.21

52470

109.190.13.144

TCP access denied by ACL from 80.12.35.21/52470 to outside-OVH:109.190.13.144/80

Indeed, I removed my previous nat for testing.

Arthur

Can you do a "sh nat" again

Jon Marshall — Sat, 14 Mar 2015 19:17:14 GMT

Can you do a "sh nat" again and post the output.

And from the CLI can you run the packet-tracer command, I made a mistake on the interface name so -

"packet-tracer input outside-OVH tcp 8.8.8.8 12345 <public IP of web server> 80"

Jon

Please find the file in

Arthur DENIS — Sat, 14 Mar 2015 19:44:50 GMT

Please find the file in attached.

Thanks,

Arthur

The problem is it is not

Jon Marshall — Sat, 14 Mar 2015 20:14:55 GMT

The problem is it is not using your static NAT statements which usually means it is matching one of your rules before that.

Although I can't see which rule it would be matching.

Can you try doing a "clear xlate" and retesting.

Jon

I send a "clear xlate"

Arthur DENIS — Sat, 14 Mar 2015 21:29:01 GMT

I send a "clear xlate" command, but it remain the same issue (syslog id 710003).

Maybe is the issue occur because I try to NAT outside to inside with the same IP address that the outside-OVH interface?

Arthur

ArthurYou mean this line -nat

Jon Marshall — Sun, 15 Mar 2015 12:21:14 GMT

Arthur

You mean this line -

nat (outside-OVH,VLAN1) source dynamic any interface destination static NET-VLAN1 NET-VLAN1

yes, I did wonder whether that was the line that was somehow matching but as far as I understand it that should only match if the destination IP was 192.168.1.x but it won't be.

The incoming packet should have an public IP, the IP of the outside interface.

You can try removing it temporarily to see what effect it has.

Bear in mind that even if it had matched the static PAT statement it would not then have gone back to the above rule so you wouldn't have translated all the source IPs (internet IPs) to the inside interface.

Or at least that's my understanding of it.

It you do remove it and it does work then I really don't understand 8.3 NAT as well as I thought I did 🙂

Jon

Jon, I disable this line:

Arthur DENIS — Sun, 15 Mar 2015 13:27:51 GMT

Jon,

I disable this line:

nat (outside-OVH,VLAN1) 3 source dynamic any interface destination static NET-VLAN1 NET-VLAN1 inactive

But problem is already here 😞

I don't really understand why "TCP access denied by ACL", or at least by which ACL...

However, please keep in mind that my ASA is in version 9.3, not 8.3 !

Arthur

Yes sorry, I meant post 8.3

Jon Marshall — Sun, 15 Mar 2015 13:34:17 GMT

Yes sorry, I meant post 8.3 NAT which is when it all changed 🙂

Your packet-tracer output is talking about an acl but that is because it hasn't matched a NAT rule. It can be a bit misleading in terms of reading it.

What you should see in packet tracer is a specific NAT statement showing the translation but you aren't.

Can you try changing the "any" interface in your static statement to the specific interface and then retest.

Can you also post your running config again as it is now and I will have another look to see if there is anything obvious I have missed.

Jon

Ah ok :-) I change the "any"

Arthur DENIS — Sun, 15 Mar 2015 13:47:27 GMT

Ah ok 🙂

I change the "any" interface to "VLAN1" interface in my static statement. I make a clear xlate, try again... and it the same issue again!

The new sh run in attached.

Arthur

Is there any traffic going

Jon Marshall — Sun, 15 Mar 2015 14:13:46 GMT

Is there any traffic going through the ASA at the moment or this is a downtime period for you ?

If there isn't traffic we need to work out where the NAT is failing so can you -

1) run a "sh nat" and save the output

2) straight after that try and connect to the web server

3) run a "sh nat" again

we might be able to see which rule has increased in terms of translations which would give us a clue as to what is happening.

Jon

This is a downtime periode

Arthur DENIS — Sun, 15 Mar 2015 14:26:49 GMT

This is a downtime periode for me (few server remain up, but is not critical trafic).

Please find the first output "shnat1" and the second (after trying) "shnat2".

It seems that we don't match the NAT object from outside to inside trafic on http.

I believe that is not normal... An error in the config?

Arthur

Well it looks like it is

Jon Marshall — Sun, 15 Mar 2015 14:42:45 GMT

Well it looks like it is simply skipping the static NAT in section 2 and going straight to section 3.

Why it's doing that I have no idea 🙂

So we can try a couple of things.

Firstly let's move your section 3 dynamic NAT to section 2. Static takes precedence over dynamic so your statics should be used first. I just want to see if section 2 is being used at all.

So replace -

nat (VLAN1,outside-OVH) after-auto source dynamic NET-VLAN1 interface

with this -

object network NET-VLAN1
nat (VLAN1,outside-OVH) dynamic interface

then do a "sh nat" and it should show both the static and dynamic NAT entries in section 2 now.

Record the "sh nat" as before, retest and see what happens.

Jon

I make the modification, and

Arthur DENIS — Sun, 15 Mar 2015 15:02:23 GMT

I make the modification, and get the show nat output (in attached).

The problem occur again 😞

Arthur

ArthurWe'll hopefully get

Jon Marshall — Sun, 15 Mar 2015 15:12:37 GMT

Arthur

We'll hopefully get there in the end 🙂

Can you remove the static statement you currently have and add this -

nat (VLAN1,outside-OVH) source static NAT-SERVEUR-HTTP-IN NAT-SERVEUR-HTTP-IN service http http

and do the "sh nat" outputs and retest.

Jon

Yes I hope so :) I make

Arthur DENIS — Sun, 15 Mar 2015 15:21:06 GMT

Yes I hope so 🙂

I make modification, clear xlate, and... That don't work...

Sh nat result in attached.

Arthur

PS: If you want try to see in real time, maybe we can schedule a teamviewer - if you want?