topic static nat not working in Network Security

static nat not working

network770 — Tue, 12 Mar 2019 01:51:01 GMT

I have a very simple request on 8.6 code, I need to translate a public ip address to a private on a given port, I have the following :

object network obj-TEST

host 192.168.10.10

object network obj-TEST

nat (inside,outside) static 88.88.88.88

access-list incoming_outside extended permit tcp any host 88.88.88.88 eq 3389

access-group incoming_outside in interface outside

yet I am not able to RDP to 88.88.88.88 from the outside.

I checked that 192.168.10.10 is reachable from the firewall and the port is open from the inside

any idea what's wrong with this config?

object network obj-TEST
nat (inside,outside) static 206.172.40.93

Collin Clark — Thu, 30 May 2013 02:49:03 GMT

Try changing the acl from 88.88.88.88 to 192.168.10.10

Sent from Cisco Technical Support Android App

Andrew Phirsov — Thu, 30 May 2013 05:13:05 GMT

You should always use real, not mapped addresses in ACLs when working with post 8.3 code, so do what Colin said.

network770 — Thu, 30 May 2013 10:55:10 GMT

It's working now. it looks strange to allow a private ip address incoming to the outside interface, I can't seem to wrap my head around this

Jouni Forss — Thu, 30 May 2013 10:57:24 GMT

Hi Ronni,

The reason for this is the fact that NAT and ACL operations have changed in the new software.

When a connection arrives on the ASA to a NATed destination address the ASA first UNTRANSLATES that public NAT IP address to the local IP address.

So after that phase of processing the packet the destination address is already the local IP address.

When the ASA reaches the ACL phase it will therefore need to allow the traffic to the REAL IP address rather than the NAT IP address.

Hope this helps

- Jouni

adittechdha — Fri, 31 May 2013 06:44:17 GMT

i need dmz to inside configuration

DMZ Interface IP 10.1.1.1/24

DMZ Server IP 10.1.1.254

Inside Interface 192.168.11.249

Thanks and regrds

Jouni Forss — Fri, 31 May 2013 06:48:49 GMT

Hi,

Please start a new discussion for your own questions that arent related to the original topic

Depending on your software level of your firewall you might not need any NAT configuration.

- Jouni