topic Hello burleyman access-list in Network Security

Asa nat error

opnineopnine — Tue, 12 Mar 2019 05:07:54 GMT

Hi all,

I have a asa 5505 and im having the following error.

nat (inside) 0 access-list inside_nat0_outbound
ERROR: access-list has protocol or port

Any ideas?

Please post the ACL inside

burleyman — Tue, 25 Nov 2014 21:58:39 GMT

Please post the ACL inside_nat0_outbound

Hello burleyman access-list

opnineopnine — Tue, 25 Nov 2014 22:32:29 GMT

Hello burleyman

access-list inside_nat0_outbound extended permit ip any host estudio_address
access-list inside_nat0_outbound extended permit ip any 172.18.3.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 172.17.2.0 255.255.255.0 host 10.61.10.224
access-list inside_nat0_outbound extended permit ip any 12.100.64.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip any 12.100.65.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip any 12.102.0.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip any 12.100.66.0 255.255.255.0
access-list inside_nat0_outbound extended permit tcp any 12.100.64.0 255.255.255.0 eq www --this is the last one i added.

I found my own error no

opnineopnine — Tue, 25 Nov 2014 22:32:43 GMT

I found my own error

no access-list inside_nat0_outbound extended permit tcp any 12.100.64.0 255.255.255.0 eq www

nat (inside) 0 access-list inside_nat0_outbound

Is that correct?

An ACL that is used for NAT

Karsten Iwen — Tue, 25 Nov 2014 23:28:06 GMT

An ACL that is used for NAT exemption should not contain any ports. If you really need ports (based on your config, I don't think so), you have to configure static identity NAT.

Just use the following line instead of your last line:

access-list inside_nat0_outbound extended permit ip any 12.100.64.0 255.255.255.0

Hello Karsten To fix the

opnineopnine — Tue, 25 Nov 2014 23:32:49 GMT

Hello Karsten

To fix the issue i would have to erase the acl and add the nat, write?

no access-list inside_nat0_outbound extended permit tcp any 12.100.64.0 255.255.255.0 eq www

nat (inside) 0 access-list inside_nat0_outbound

Thanks.

Yes, remove the line with the

Karsten Iwen — Wed, 26 Nov 2014 00:21:44 GMT

Yes, remove the line with the port and add the same line without ports and with ip instead of tcp. That's all that has to be done..