topic Re: Static NAT on ASA in Network Security

Static NAT on ASA

Chin Chang — Fri, 21 Feb 2020 17:49:54 GMT

Dears,
I met a problem of static NAT, my asa version is 9.6 . The topology:

And configuration of devices:

[R1]v15.2
int g1/0
ip address 10.0.0.1 255.0.0.0
no shutdown
===========================
[asa]
interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 10.0.0.2 255.0.0.0

no shutdown
!
interface GigabitEthernet0/1
nameif inside
security-level 100
ip address 20.0.0.1 255.0.0.0

no shutdown
!
object network WEB
host 20.0.0.2
nat (inside,outside) static interface service tcp 80 80
nat (inside,outside) source dynamic any interface
!
access-list ICMP-WEB extended permit icmp any4 any4
access-list ICMP-WEB extended permit tcp any4 any4 eq www
access-list ICMP-WEB extended permit tcp any4 any4 eq https
access-list ICMP-WEB extended permit tcp any4 eq www any4
access-list ICMP-WEB extended permit tcp any4 eq https any4
access-group ICMP-WEB global
!
http server enable
http 0.0.0.0 0.0.0.0 inside

http 0.0.0.0 0.0.0.0 outside
===========================
[R2]v15.2
int g1/0
ip address 20.0.0.2 255.0.0.0
no shutdown
!
no ip routing
ip default-gateway 20.0.0.1

===========================

I have completed PAT on ASA. R2 can ping R1(10.0.0.1) that has ICMP reply, and R2 can telnet 20.0.0.2 80(R2-self).

R1#telnet 10.0.0.2 80
Trying 10.0.0.2, 80 ...
%Connection timed out; remote host not responding

R1#

R2#telnet 20.0.0.2 80
Trying 20.0.0.2, 80 ... Open
get
HTTP/1.1 400 Bad Request
Date: Tue, 14 Jan 2020 10:51:37 GMT
Server: cisco-IOS
Accept-Ranges: none

400 Bad Request
[Connection to 20.0.0.2 closed by foreign host]
R2#

===============================

But I don't know why R1 can not telnet ASA(10.0.0.2) 80.

Regards.

Re: Static NAT on ASA

Muhammad Awais Khan — Tue, 14 Jan 2020 06:03:03 GMT

ASA is not running any webservice on port 80 thats why you cannot. Can you please elaborate on what are you trying to achieve so we can help you more ?

Re: Static NAT on ASA

danilov.do — Tue, 14 Jan 2020 06:05:09 GMT

Hello!

I think you should remove second nat defintion in object-nat configuration that is:

!
object network WEB
 host 20.0.0.2
 nat (inside,outside) static interface service tcp 80 80
!

--
Dmitry.

Re: Static NAT on ASA

Chin Chang — Tue, 14 Jan 2020 07:12:48 GMT

Hi Muhammad Awais Khan,
"ASA is not running any webservice on port 80 thats why you cannot."
However, I have set http server enable, http 0.0.0.0 0.0.0.0 outside. ASA is running http, right?

"Can you please elaborate on what are you trying to achieve so we can help you more ?"
I just doing lab. HAHA

Re: Static NAT on ASA

Chin Chang — Tue, 14 Jan 2020 07:27:10 GMT

Hi danilov.do,
"I think you should remove second nat defintion in object-nat configuration"
But ASA has only PAT if remove it. Without static NAT.