topic NAT translation in Network Security

NAT translation

Alfred — Tue, 12 Mar 2019 00:11:27 GMT

I have a DGway of 31.210.99.10/27 and i want to translate the ip addr to 192.168.xx.xx ( internal ip SNMP) to 31.210.99.xx/27

i did the commands

static (inside,outside) 31.210.99.xx 192.168.xx.xx metmask 255.255.255.255

access-list 101 permit tcp any host 31.21099.xx eq 25

access-group 101 in interface outside

And this is not working

This is not working Can some one help??

NAT translation

Julio Carvajal — Thu, 18 Oct 2012 17:53:13 GMT

Hello Alfred,

Configuration looks good..

Let's start with a packet-tracer

packet-tracer input outside tcp 4.2.2.2 1025 31.210.99.xx 25

Let us know the result

Re: NAT translation

saurabhgoel169 — Thu, 18 Oct 2012 18:15:50 GMT

you are using wrong port number SNMP works on 161 port number and your are giving SMTP port number i.e 25

atic (inside,outside) 31.210.99.xx 192.168.xx.xx metmask 255.255.255.255

access-list 101 permit udp any host 31.21099.xx eq 161

access-group 101 in interface outside

please check and reply

Re: NAT translation

Alfred — Thu, 18 Oct 2012 18:53:46 GMT

Saurabn

i meant SMTP(port 25).the thing is i cannot even ping 192.168.xx.xx before and after the NAtting rule was applied.Went to this web site to test connectivity https://www.wormly.com/test_smtp_server and nothing happened..dont know why.

Is there any thing missing here???Help please!!

Re: NAT translation

Julio Carvajal — Thu, 18 Oct 2012 18:58:17 GMT

Hello Alfred,

Configuration looks good..

Let's start with a packet-tracer

packet-tracer input outside tcp 4.2.2.2 1025 31.210.99.xx 25

Let us know the result

NAT translation

saurabhgoel169 — Thu, 18 Oct 2012 18:59:50 GMT

From where you are try to ping the 192.168.x.x IP address and if you want to test the setting please do the telent from your machine to

Public IP

exam:

telnet Public_IP 25

If it is successfull , it means your configuration is working fine

Show the status....

which IOS you are using on firewall

Check and let me knwo

NAT translation

Alfred — Thu, 18 Oct 2012 19:52:12 GMT

IOS image used is 8.2(3) and ASDM 6..

Saurabh goe

no access to device at the moment will let u know of packet tracer..the thing is i cannot ping the SMTP server fromthe firewall even before the translation.

NAT translation

saurabhgoel169 — Fri, 19 Oct 2012 07:02:07 GMT

Hello Alfred,

Your SMTP server should be reachable from the firewall. You need to check the route for the SMTP server and share the traceroute result to SMTP server from firewall. Might be it will help you to check the reachability of server

NAT translation

Alfred — Fri, 19 Oct 2012 08:22:18 GMT

Saurabh ,

here is the packet tracer,

ASA(config)# packet-tracer input outside tcp 4.2.2.2 1025 31.xxx.9$

Phase: 1

Type: ACCESS-LIST

Subtype:

Result: ALLOW

Config:

Implicit Rule

Additional Information:

MAC Access list

Phase: 2

Type: FLOW-LOOKUP

Subtype:

Result: ALLOW

Config:

Additional Information:

Found no matching flow, creating a new flow

Phase: 3

Type: ROUTE-LOOKUP

Subtype: input

Result: ALLOW

Config:

Additional Information:

in 0.0.0.0 0.0.0.0 outside

Phase: 4

Type: ACCESS-LIST

Subtype:

Result: DROP

Config:

Implicit Rule

Additional Information:

Result:

input-interface: outside

input-status: up

input-line-status: up

output-interface: outside

output-status: up

output-line-status: up

Action: drop

Drop-reason: (acl-drop) Flow is denied by configured rule

NAT translation

Alfred — Fri, 19 Oct 2012 08:28:07 GMT

this is what was added:

static (inside,outside) 38.xx.xx.xx 192.168.xx.xx netmask 255.255.255.255

access-list 101 permit tcp any host 38.xx.xx.xx eq 25

access-group 101 in interface outside

NAT translation

Alfred — Fri, 19 Oct 2012 08:45:19 GMT

hello to b on the safe side i deteledt the rule and added it again and i carry out the pacte tracer and the result:

ASA-1# packet-tracer input outside tcp 4.2.2.2 1025 31.xx.xx.xx 25

Phase: 1

Type: FLOW-LOOKUP

Subtype:

Result: ALLOW

Config:

Additional Information:

Found no matching flow, creating a new flow

Phase: 2

Type: UN-NAT

Subtype: static

Result: ALLOW

Config:

static (inside,outside) 31.xx.xx.xx 192.168.xx.xx netmask 255.255.255.255

match ip inside host 192.168.98.35 outside any

static translation to 31.210.233.69

translate_hits = 0, untranslate_hits = 3

Additional Information:

NAT divert to egress interface inside

Untranslate 31.xx.xx.xx /0 to 192.168.xx.xx/0 using netmask 255.255.255.255

Phase: 3

Type: ACCESS-LIST

Subtype: log

Result: ALLOW

Config:

access-group 101 in interface outside

access-list 101 extended permit tcp any host 38.xx.xx.xx.xx eq smtp

Additional Information:

Phase: 4

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Phase: 5

Type: INSPECT

Subtype: inspect-smtp

Result: ALLOW

Config:

class-map inspection_default

match default-inspection-traffic

policy-map global_policy

class inspection_default

inspect esmtp _default_esmtp_map

service-policy global_policy global

Additional Information:

Phase: 6

Type: VPN

Subtype: ipsec-tunnel-flow

Result: ALLOW

Config:

Additional Information:

Phase: 7

Type: NAT

Subtype: rpf-check

Result: ALLOW

Config:

static (inside,outside) 31.xx.xx.xx 192.168.xx.xx netmask 255.255.255.255

match ip inside host 192.168.xx.xx outside any

static translation to 31.xx.xx.xx

translate_hits = 0, untranslate_hits = 3

Additional Information:

Phase: 8

Type: NAT

Subtype: host-limits

Result: ALLOW

Config:

static (inside,outside) 31.xx.xx.xx 192.168.xx.xx netmask 255.255.255.255

match ip inside host 192.168.98.35 outside any

static translation to 31.xx.xx.xx

translate_hits = 0, untranslate_hits = 3

Additional Information:

Phase: 9

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Phase: 10

Type: FLOW-CREATION

Subtype:

Result: ALLOW

Config:

Additional Information:

New flow created with id 96282, packet dispatched to next module

Result:

input-interface: outside

input-status: up

input-line-status: up

output-interface: inside

output-status: up

output-line-status: up

Action: allow

NAT translation

saurabhgoel169 — Fri, 19 Oct 2012 14:43:50 GMT

Hi Albert,

Now its working fine for your..

Cheers

Saurabh

NAT translation

Alfred — Fri, 19 Oct 2012 15:20:07 GMT

Saurabh goel

No not working

went to the web site https://www.wormly.com/test_smtp_server..Did some tests and nothing..its not working at all..Can you help or any body??..is there anymire access lus to be added,,thought i did this right.

NAT translation

Julio Carvajal — Fri, 19 Oct 2012 16:18:36 GMT

Hello Alfred,

The ASA configuration is the one required now.

Do the following as a test in order to make sure this is a server issue:

access-list test123 permit tcp any host 38.xx.xx.xx.xx eq 25

nat (outside) 11 access-list test123 outside

global (inside) 11 interface

Then give it a try, if this does not work captures will be taken next!

Any other question...Sure..Just remember to rate all of my posts

NAT translation

Alfred — Sun, 21 Oct 2012 12:54:59 GMT

Hello,

just wanted to confirm the internal mail server is 192.168.xx.xx

and the ip addr we want to come through the Fwall is 38.210.xx.18.and the gateway of the firewall is 38.210.xx.20

NAT translation

Julio Carvajal — Sun, 21 Oct 2012 19:05:01 GMT

Hello Alfred,

Yes, we know..

The configuration you have is the one required.

Now it looks like it's a server problem but just to make sure do the following and them attempt to connect:

access-list test123 permit tcp any host 38.xx.xx.xx.xx eq 25

nat (outside) 11 access-list test123 outside

global (inside) 11 interface

Regards,

NAT translation

Alfred — Mon, 22 Oct 2012 09:24:08 GMT

Hi,

Still no joy cant ping the mail server at all..

Phase: 3

Type: ACCESS-LIST

Subtype: log

Result: ALLOW

Config:

access-group 101 in interface outside

access-list 101 extended permit tcp any host 38.210.x.x eq smtp

Additional Information:

Phase: 4

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Phase: 5

Type: INSPECT

Subtype: inspect-smtp

Result: ALLOW

Config:

class-map inspection_default

match default-inspection-traffic

policy-map global_policy

class inspection_default

inspect esmtp _default_esmtp_map

service-policy global_policy global

Additional Information:

Phase: 6

Type: VPN

Subtype: ipsec-tunnel-flow

Result: ALLOW

Config:

Additional Information:

Phase: 7

Type: NAT

Subtype:

Result: ALLOW

Config:

nat (outside) 11 access-list test123 outside

match tcp outside any inside host 38.xx.xx.xxeq 25

dynamic translation to pool 11 (0.0.0.0 [Interface PAT])

translate_hits = 1, untranslate_hits = 0

Additional Information:

Dynamic translate 4.2.2.2/1025 to 0.0.0.0/54329 using netmask 255.255.255.255

Phase: 8

Type: NAT

Subtype: host-limits

Result: ALLOW

Config:

nat (outside) 11 access-list test123 outside

match tcp outside any outside host 38.xx.xx.xx eq 25

dynamic translation to pool 11 (No matching global)

translate_hits = 0, untranslate_hits = 0

Additional Information:

Phase: 9

Type: NAT

Subtype: rpf-check

Result: ALLOW

Config:

static (inside,outside) 38.xx.xx.xx 192.168.xx.xx netmask 255.255.255.255

match ip inside host 192.168.xx.xx outside any

static translation to 38.xx.xx.xx

translate_hits = 0, untranslate_hits = 4

Additional Information:

Phase: 10

Type: NAT

Subtype: host-limits

Result: ALLOW

Config:

static (inside,outside) 38.xx.xx.xx 192.168.xx.xx netmask 255.255.255.255

match ip inside host 192.168.xx.xx outside any

static translation to 38.xx.xx.xx

translate_hits = 0, untranslate_hits = 4

Additional Information:

Phase: 11

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Phase: 12

Type: FLOW-CREATION

Subtype:

Result: ALLOW

Config:

Additional Information:

New flow created with id 448872, packet dispatched to next module

Result:

input-interface: outside

input-status: up

input-line-status: up

output-interface: inside

output-status: up

output-line-status: up

Action: allow

NAT translation

Julio Carvajal — Mon, 22 Oct 2012 16:33:29 GMT

Hello,

Are you trying to ping it????

That is completely different, we have been working with the SMTP protocol not ICMP???

Please clear that out.

Remembe to rate all of the helpful posts, for us that is as important as a thanks.

NAT translation

Alfred — Tue, 23 Oct 2012 11:03:00 GMT

im trying to go through the default gateway instead.whats the port number of a default gateway?

NAT translation

Julio Carvajal — Tue, 23 Oct 2012 16:34:16 GMT

Hello Alfred,

I am affraid you are not being clear enough,

I am sorry but I do not understand what you are trying to do.

I mean right now you should be trying to access the internal server on port 25. That's all we have done so far.

Regards