topic Vlan1 to Vlan2 through Outside interface in Network Security

Vlan1 to Vlan2 through Outside interface

Pete Sullivan — Mon, 11 Mar 2019 23:04:39 GMT

Using ASA 8.2(5)

I'm trying to figure out how allow traffic from a host on Vlan2 to Vlan1 using the public address that is NAT'd on the outside interface to a device on Vlan1.

Desired traffic flow

10.100.8.123 (vlan2) ====> 50.50.50.50 (public address) ====> 10.100.1.122 (vlan1)

Current Config

interface Vlan1

nameif vlan1

security-level 100

ip address 10.100.1.254 255.255.255.0

interface Vlan2

nameif vlan2

security-level 100

ip address 10.100.8.254 255.255.255.0

interface Vlan200

nameif outside

security-level 0

ip address 192.168.50.75 255.255.255.0

static (vlan1,outside) 50.50.50.50 10.100.1.122 netmask 255.255.255.255

global (outside) 101 interface

access-group out_acl in interface outside

nat (vlan1) 0 access-list inside_outbound_nat0_acl

nat (vlan1) 101 0.0.0.0 0.0.0.0

nat (vlan2) 0 access-list inside_outbound_nat0_acl

nat (vlan2) 101 0.0.0.0 0.0.0.0

access-list inside_outbound_nat0_acl extended permit ip 10.100.8.0 255.255.255.0 10.100.1.0 255.255.255.0

access-list inside_outbound_nat0_acl extended permit ip 10.100.1.0 255.255.255.0 10.0.0.0 255.0.0.0

access-list out_acl extended permit icmp any host 50.50.50.50 object-group ping log

access-list out_acl extended permit tcp any host 50.50.50.50 object-group Ports-Servers-PVO

object-group service Ports-Servers-PVO tcp

port-object eq www

port-object eq https

port-object eq 3389

As you can see in the above config, traffic can flow directly from vlan2 to vlan1 (and back), and outside traffic can access 10.100.1.122 through the translated address 50.50.50.50. These functions are working, but when vlan2 tries to access 10.100.1.122 on vlan1 through the public (50.50.50.50) address, the error message below is logged:

305013 172.20.1.1 Asymmetric NAT rules matched for forward and reverse flows; Connection for icmp src outside:10.100.8.123 dst vlan1:172.20.1.1 (type 8, code 0) denied due to NAT reverse path failure

Please help! Like all things Cisco, I feel like the solution would be simple yet far away.

Vlan1 to Vlan2 through Outside interface

varrao — Wed, 09 May 2012 22:44:40 GMT

Hi Pete,

you need to add these:

static (vlan1,vlan2) 50.50.50.50 10.100.1.122

same-security-traffic permit inter-interface

This should work.

Thanks,
Varun Rao
Security Team,
Cisco TAC

Re: Vlan1 to Vlan2 through Outside interface

Pete Sullivan — Thu, 10 May 2012 14:43:35 GMT

Thank you Varun, I added this line to the config:

static (vlan1,vlan2) 50.50.50.50 10.100.1.122

And verified that this line was already in the config:

same-security-traffic permit inter-interface

I've also added this ACL

access-list inside_outbound_nat0_acl extended permit ip 10.0.0.0 255.0.0.0 172.20.0.0 255.255.0.0

But the same error message below was generated when I tried to ping 172.20.1.1 from the 10.100.8.0 network:

305013 50.50.50.50 Asymmetric NAT rules matched for forward and reverse flows; Connection for icmp src outside:10.100.8.123 dst vlan1:50.50.50.50 (type 8, code 0) denied due to NAT reverse path failure

What am I missing to make this work? (I ran the clear xlate command after making these changes).

Vlan1 to Vlan2 through Outside interface

Dan-Ciprian Cicioiu — Thu, 10 May 2012 15:17:36 GMT

Hi Pete,

Please post :

show run static

show run route

show access-list inside_outbound_nat0_acl

Anyway if you want this traffic get nat-ed, it will not happend for sure with if you add the flow on nat exempt acl.

Dan

Vlan1 to Vlan2 through Outside interface

Pete Sullivan — Thu, 10 May 2012 15:30:22 GMT

This is the output from the sh run static. I used 50.50.50.50 in my example to represent what is 172.20.1.1 in the static entries below.

static (vlan1,outside) 172.20.1.1 10.100.1.122 netmask 255.255.255.255

static (vlan1,vlan2) 172.20.1.1 10.100.1.122 netmask 255.255.255.255

sh run route

route outside 0.0.0.0 0.0.0.0 192.168.50.1 1

sh run access-list inside_outbound_nat0_acl

access-list inside_outbound_nat0_acl extended permit ip 10.100.1.0 255.255.255.0 10.0.0.0 255.0.0.0

access-list inside_outbound_nat0_acl extended permit ip 10.100.8.0 255.255.255.0 10.100.1.0 255.255.255.0

access-list inside_outbound_nat0_acl extended permit ip 10.100.8.0 255.255.255.0 172.20.1.0 255.255.255.0

access-list inside_outbound_nat0_acl extended permit ip 10.0.0.0 255.0.0.0 172.20.0.0 255.255.0.0

Can you help me understand what this means?

Anyway if you want this traffic get nat-ed, it will not happend for sure with if you add the flow on nat exempt acl.

Are you saying that I need to add a flow on nat exempt acl?

Vlan1 to Vlan2 through Outside interface

Dan-Ciprian Cicioiu — Thu, 10 May 2012 15:58:02 GMT

Pete first of all

Anyway if you want this traffic get nat-ed, it will not happend for sure with if you add the flow on nat exempt acl.

Are you saying that I need to add a flow on nat exempt acl?

No, I am sayin that you should not add this traffic ( 10.100.8.0/24 ->10.100.1.0/24 ) on nat exemption.

This is what I saw in your initial config :

nat (vlan1) 0 access-list inside_outbound_nat0_acl

nat (vlan2) 0 access-list inside_outbound_nat0_acl

access-list inside_outbound_nat0_acl extended permit ip 10.100.8.0 255.255.255.0 10.100.1.0 255.255.255.0

access-list inside_outbound_nat0_acl extended permit ip 10.100.1.0 255.255.255.0 10.0.0.0 255.0.0.0

You must reconfigure your static statement:

no static (vlan1,vlan2) 172.20.1.1 10.100.1.122 netmask 255.255.255.255

static (vlan1,vlan2) 50.50.50.50 10.100.1.122 netmask 255.255.255.255

Dan

Re: Vlan1 to Vlan2 through Outside interface

Pete Sullivan — Thu, 10 May 2012 18:08:08 GMT

Dan, I think you did not understand what I was saying when I said "I used 50.50.50.50 in my example to represent what is 172.20.1.1 in the static entries below". The 50.50.50.50 address was only used as an example so that it would be apparent that I was trying to route traffic from an inside vlan to a public address on the ASA which is NAT'd to another address on the inside. Instead of the 50.50.50.50 address, I am actually using 172.20.1.1, so my config looks like this:

Current Config

interface Vlan1

nameif vlan1

security-level 100

ip address 10.100.1.254 255.255.255.0

interface Vlan2

nameif vlan2

security-level 100

ip address 10.100.8.254 255.255.255.0

interface Vlan200

nameif outside

security-level 0

ip address 192.168.50.75 255.255.255.0

static (vlan1,outside) 172.20.1.1 10.100.1.122 netmask 255.255.255.255

static (vlan1,vlan2) 172.20.1.1 10.100.1.122 netmask 255.255.255.255

global (outside) 101 interface

access-group out_acl in interface outside

nat (vlan1) 101 0.0.0.0 0.0.0.0

nat (vlan2) 101 0.0.0.0 0.0.0.0

nat (outside) 0 access-list inside_outbound_nat0_acl

access-list inside_outbound_nat0_acl extended permit ip 10.100.8.0 255.255.255.0 10.100.1.0 255.255.255.0

access-list inside_outbound_nat0_acl extended permit ip 10.100.1.0 255.255.255.0 10.0.0.0 255.0.0.0

access-list out_acl extended permit tcp any host 10.100.1.122

access-list out_acl extended permit icmp any host 172.20.1.1 object-group ping log

access-list out_acl extended permit tcp any host 172.20.1.1 object-group Ports-Servers-PVO

object-group service Ports-Servers-PVO tcp

port-object eq www

port-object eq https

port-object eq 3389

My question is: How can I allow 10.100.8.0/24 on vlan2 access to 172.20.1.1 (which is the public address NAT'd to the vlan1 address 10.100.1.122)? What in my configuration needs to be changed/added?

I tried removing the two ACL entries from the inside_outbound_nat0_acl but that only caused the traffic between vlan1 and vlan2 to quit working, it did not help with allowing vlan2 access to the 172.20.1.1 address.

Thanks