topic Static Port Address Translation 8.4 in Network Security

Static Port Address Translation 8.4

estelamathew — Mon, 11 Mar 2019 22:06:23 GMT

Hello Experts,

Is the static Port Address Translation is bidirectional in 8.4 ???

I have configured static port address translation for the 2 server with same Public IP for the port 80 and 23. The strange thing is when they initiate a connection to the outside world they are allowed access to the internet as they are not included in the Dynamic Port address translation pool.

object network inside network.

subnet 192.168.10.0 255.255.255.0

Can anybody help me.

Thanks

Static Port Address Translation 8.4

ajay chauhan — Sat, 24 Dec 2011 16:16:49 GMT

Please post your configuration.

Re: Static Port Address Translation 8.4

estelamathew — Sat, 24 Dec 2011 19:00:14 GMT

ciscoasa(config-network-object)# sh running-config

: Saved

ASA Version 8.4(2)

hostname ciscoasa

enable password 8Ry2YjIyt7RRXU24 encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

interface Ethernet0/0

nameif outside

security-level 0

ip address 192.168.20.1 255.255.255.0

interface Ethernet0/1

nameif inside

security-level 100

ip address 192.168.10.1 255.255.255.0

interface Ethernet0/2

shutdown

no nameif

no security-level

no ip address

interface Ethernet0/3

shutdown

no nameif

no security-level

no ip address

interface Management0/0

nameif management

security-level 100

ip address 192.168.1.1 255.255.255.0

management-only

ftp mode passive

object network all

subnet 192.168.10.0 255.255.255.0

object network static

host 2.2.2.2

object network PAT

host 10.10.10.1

access-list outside extended permit tcp any host 2.2.2.2 eq telnet

access-list outside extended permit tcp any host 10.10.10.1 eq www

pager lines 24

logging enable

logging buffered notifications

logging asdm informational

mtu outside 1500

mtu inside 1500

mtu management 1500

no failover

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

object network all

nat (inside,outside) dynamic 192.168.20.5

object network static

nat (inside,outside) static 3.3.3.3 service tcp telnet telnet

object network PAT

nat (inside,outside) static 3.3.3.3 service tcp 8080 www

access-group outside in interface outside

route outside 0.0.0.0 0.0.0.0 192.168.20.2 1

route inside 2.2.2.0 255.255.255.0 192.168.10.2

route inside 10.10.10.0 255.255.255.0 192.168.10.2

Static Port Address Translation 8.4

Julio Carvajal — Sat, 24 Dec 2011 19:13:10 GMT

Hello Estela,

You are doing port-forwarding, this kind of nat is just for inbound connections.

Static will always be bi-directional, port-forwarding will be for communications innitiated on the lower security level interface.

Regards,

Julio

Static Port Address Translation 8.4

estelamathew — Sat, 24 Dec 2011 19:21:11 GMT

yes correct ,

But when these server initiate a connection by what IP they will go out.??/

Re: Static Port Address Translation 8.4

Julio Carvajal — Sat, 24 Dec 2011 19:37:33 GMT

Hello,

Will use the PAT ip address : 192.168.20.5

Regards,

Do rate helpful posts

Julio

Re: Static Port Address Translation 8.4

estelamathew — Sat, 24 Dec 2011 19:47:52 GMT

yes,

This is my concern, this is what not happening just see the logs below. I just initiate a connection from these servers and it is successful though their addresses are not included in PAT pool, still they are going out, how come??????????????

ciscoasa(config)# sh conn

1 in use, 10 most used

TCP outside 1.1.1.1:23 inside 10.10.10.1:14811, idle 0:00:12, bytes 149, flags UIO

ciscoasa(config)# sh xlate

2 in use, 4 most used

Flags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twice

TCP PAT from inside:2.2.2.2 23-23 to outside:3.3.3.3 23-23

flags sr idle 0:41:35 timeout 0:00:00

TCP PAT from inside:10.10.10.1 8080-8080 to outside:3.3.3.3 80-80

flags sr idle 0:02:29 timeout 0:00:00

ciscoasa(config)# sh local-host

Interface management: 0 active, 0 maximum active, 0 denied

Interface inside: 1 active, 2 maximum active, 0 denied

local host: <10.10.10.1>,

TCP flow count/limit = 1/unlimited

TCP embryonic count to host = 0

TCP intercept watermark = unlimited

UDP flow count/limit = 0/unlimited

Conn:

TCP outside 1.1.1.1:23 inside 10.10.10.1:14811, idle 0:01:01, bytes 149, flags UIO

Interface outside: 1 active, 5 maximum active, 0 denied

local host: <1.1.1.1>,

TCP flow count/limit = 1/unlimited

TCP embryonic count to host = 0

TCP intercept watermark = unlimited

UDP flow count/limit = 0/unlimited

Conn:

TCP outside 1.1.1.1:23 inside 10.10.10.1:14811, idle 0:01:01, bytes 149, flags UIO

Re: Static Port Address Translation 8.4

Julio Carvajal — Sat, 24 Dec 2011 20:18:58 GMT

Hello Estela,

I see what you are saying,

Can you provide the following packet-tracer

packet-tracer input inside tcp 192.168.10.5 1025 4.2.2.2 80

Regards,

Do please rate helpful posts

Julio

Re: Static Port Address Translation 8.4

estelamathew — Sat, 24 Dec 2011 20:24:07 GMT

Hello,

U need the captured packets, from inside to outside, if i m not wrong.

I did'nt understood the below line, i dont have the following IP's in my network, i hope it is an example.

packet-tracer input inside tcp 192.168.10.5 1025 4.2.2.2 80

Re: Static Port Address Translation 8.4

Julio Carvajal — Sat, 24 Dec 2011 20:37:41 GMT

Hello Stela,

This will show us all the nat rules, acl, routes that the traffic for that host is hitting, of course is an example. you can use any host on that network.

Regards,

Julio

Re: Static Port Address Translation 8.4

estelamathew — Sun, 25 Dec 2011 06:55:20 GMT

Hello Dears

Packet tracer for the Static port redirection server IP's.

ciscoasa(config)# sh conn

1 in use, 1 most used

TCP outside 1.1.1.1:23 inside 2.2.2.2:28826, idle 0:00:09, bytes 149, flags UIO

ciscoasa(config)# sh xlate

2 in use, 3 most used

Flags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twice

TCP PAT from inside:2.2.2.2 23-23 to outside:3.3.3.3 23-23

flags sr idle 2:11:34 timeout 0:00:00

TCP PAT from inside:10.10.10.1 8080-8080 to outside:3.3.3.3 80-80

flags sr idle 2:11:34 timeout 0:00:00

ciscoasa(config)# sh local-host

Interface management: 0 active, 0 maximum active, 0 denied

Interface inside: 1 active, 2 maximum active, 0 denied

local host: <2.2.2.2>,

TCP flow count/limit = 1/unlimited

TCP embryonic count to host = 0

TCP intercept watermark = unlimited

UDP flow count/limit = 0/unlimited

Conn:

TCP outside 1.1.1.1:23 inside 2.2.2.2:28826, idle 0:00:21, bytes 149, flags UIO

Interface outside: 1 active, 1 maximum active, 0 denied

local host: <1.1.1.1>,

TCP flow count/limit = 1/unlimited

TCP embryonic count to host = 0

TCP intercept watermark = unlimited

UDP flow count/limit = 0/unlimited

Conn:

TCP outside 1.1.1.1:23 inside 2.2.2.2:28826, idle 0:00:21, bytes 149, flags UIO

ciscoasa(config)# packet-tracer input inside tcp 2.2.2.2 28826 1.1.1.1 23

Phase: 1

Type: FLOW-LOOKUP

Subtype:

Result: ALLOW

Config:

Additional Information:

Found flow with id 15, using existing flow

Result:

input-interface: inside

input-status: up

input-line-status: up

Action: allow

#####################################################################################

ciscoasa(config)# sh conn

1 in use, 1 most used

TCP outside 1.1.1.1:23 inside 10.10.10.1:31862, idle 0:00:18, bytes 149, flags UIO

ciscoasa(config)# sh xlate

2 in use, 3 most used

Flags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twice

TCP PAT from inside:2.2.2.2 23-23 to outside:3.3.3.3 23-23

flags sr idle 2:15:10 timeout 0:00:00

TCP PAT from inside:10.10.10.1 8080-8080 to outside:3.3.3.3 80-80

flags sr idle 2:15:10 timeout 0:00:00

ciscoasa(config)# sh local-host

Interface management: 0 active, 0 maximum active, 0 denied

Interface inside: 1 active, 2 maximum active, 0 denied

local host: <10.10.10.1>,

TCP flow count/limit = 1/unlimited

TCP embryonic count to host = 0

TCP intercept watermark = unlimited

UDP flow count/limit = 0/unlimited

Conn:

TCP outside 1.1.1.1:23 inside 10.10.10.1:31862, idle 0:00:36, bytes 149, flags UIO

Interface outside: 1 active, 1 maximum active, 0 denied

local host: <1.1.1.1>,

TCP flow count/limit = 1/unlimited

TCP embryonic count to host = 0

TCP intercept watermark = unlimited

UDP flow count/limit = 0/unlimited

Conn:

TCP outside 1.1.1.1:23 inside 10.10.10.1:31862, idle 0:00:36, bytes 149, flags UIO

ciscoasa(config)# packet-tracer input inside tcp 10.10.10.1 31862 1.1.1.1 23

Phase: 1

Type: FLOW-LOOKUP

Subtype:

Result: ALLOW

Config:

Additional Information:

Found flow with id 17, using existing flow

Result:

input-interface: inside

input-status: up

input-line-status: up

Action: allow

Thanks

Static Port Address Translation 8.4

ajay chauhan — Sun, 25 Dec 2011 07:39:55 GMT

Post full trace all phase.

Re: Static Port Address Translation 8.4

Julio Carvajal — Sun, 25 Dec 2011 07:41:58 GMT

Hello Estela,

You are using an exisiting flow for the packet tracer that is not what I am looking for.....

I want you to do the following packet tracer please!

packet-tracer input inside tcp 10.10.10.1 1025 1.1.1.1 23

Re: Static Port Address Translation 8.4

estelamathew — Sun, 25 Dec 2011 08:37:49 GMT

The source port what i m using is 23 and the destination is also 23 , Is it OK or i m wrong.Please correct if this is not enough.

In such case when i don't know the source port what i shld use.

ciscoasa(config)# packet-tracer input inside tcp 2.2.2.2 23 1.1.1.1 23

Phase: 1

Type: ROUTE-LOOKUP

Subtype: input

Result: ALLOW

Config:

Additional Information:

in 0.0.0.0 0.0.0.0 outside

Phase: 2

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Phase: 3

Type: NAT

Subtype:

Result: ALLOW

Config:

object network static

nat (inside,outside) static 3.3.3.3 service tcp telnet telnet

Additional Information:

Static translate 2.2.2.2/23 to 3.3.3.3/23

Phase: 4

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Phase: 5

Type: FLOW-CREATION

Subtype:

Result: ALLOW

Config:

Additional Information:

New flow created with id 2368, packet dispatched to next module

Result:

input-interface: inside

input-status: up

input-line-status: up

output-interface: outside

output-status: up

output-line-status: up

Action: allow

Re: Static Port Address Translation 8.4

Julio Carvajal — Sun, 25 Dec 2011 18:22:46 GMT

Hello Estela,

You need to use a random port, but for this monitoring purposes its okay, I saw what I was looking for.

That traffic is hitting the static rule, seems like on ASA version 8.3 and prior the static port-forwarding will be taken biderectional.

Are you looking for just inbound connections or it is okay if its bi-derectional?

Regards,

Julio

Static Port Address Translation 8.4

estelamathew — Sun, 25 Dec 2011 19:25:42 GMT

Tx Julio,

Suppose if i m looking only inbound then what i have to do??

Thanks