topic Re: Cannot get Alias or Static NAT inside to work in Network Security

Cannot get Alias or Static NAT inside to work

jburk — Mon, 11 Mar 2019 16:02:54 GMT

ok, so I have a web server with an internal IP of 10.x.x.x and it has a static NAT to the outside with a public 216.x.x.x address on the ASA - my internal hosts cannot access it via the public address. so I tried to nat it like this

static (inside,inside) 216.x.x.x 10.x.x.x netmask 255.255.255.255

and it did not work

so I did

alias (inside) 216.x.x.x 10.x.x.x 255.255.255.255

and I can ping it from an inside host, but still cannot access http://216.x.x.x - when I ping 216.x.x.x it replies with 10.x.x.x address

if I put http://10.x.x.x it works fine

it is an ASA 5510 Security+ on 8.21

Re: Cannot get Alias or Static NAT inside to work

acomiskey — Wed, 05 Aug 2009 15:18:49 GMT

same-security-traffic permit intra-interface

static (inside,inside) 216.x.x.x 10.x.x.x netmask 255.255.255.255

global (inside) 1 interface

nat (inside) 1 0 0

Re: Cannot get Alias or Static NAT inside to work

jburk — Wed, 05 Aug 2009 16:57:09 GMT

ok, the static command works to replace the alias, I had the same security permit intra and inter interface, changed the inside nat pool from 0 to 1 and it is working I can ping and http

will this affect my outbound identity addresses? like if I have a web filter outside the ASA will it now see all traffic coming from the ASA interface instead of the identity of the client PC?

I wasn't doing any NAT overload on the ASA, there is a router from the ISP doing that from their IP pool. I was just doing identity nat

Re: Cannot get Alias or Static NAT inside to work

acomiskey — Wed, 05 Aug 2009 17:16:27 GMT

"will this affect my outbound identity addresses?"

-No. Only traffic from inside to inside is affected.

Re: Cannot get Alias or Static NAT inside to work

jburk — Wed, 05 Aug 2009 17:17:49 GMT

I spoke too soon - it broke my internet for inside hosts, I changed it back to nat pool 0 and internet works, but of course now I cant talk to the server

Re: Cannot get Alias or Static NAT inside to work

acomiskey — Wed, 05 Aug 2009 17:48:18 GMT

Post your nat/global config please.

You should be able to leave your existing nat 0 then add...

nat (inside) 1 0 0

global (inside) 1 interface

Re: Cannot get Alias or Static NAT inside to work

jburk — Wed, 05 Aug 2009 18:25:19 GMT

global (inside) 1 interface

nat (management) 0 0.0.0.0 0.0.0.0

nat (inside) 0 0.0.0.0 0.0.0.0

static (inside,outside) 216.x.x.x 10.17.1.42 netmask 255.255.255.255

static (inside,outside) 216.x.x.x 10.17.1.45 netmask 255.255.255.255

static (inside,outside) 216.x.x.x 10.17.1.43 netmask 255.255.255.255

static (inside,outside) 216.x.x.x 10.17.1.46 netmask 255.255.255.255

static (inside,outside) 216.x.x.x 10.17.1.44 netmask 255.255.255.255

static (inside,outside) 216.x.x.x 10.17.1.33 netmask 255.255.255.255

static (inside,inside) 216.x.x.x 10.17.1.42 netmask 255.255.255.255

if I change to

nat (inside) 1 0 0

I can't get to the internet on any hosts that don't have a static, I don't really want to overload on my outside interface on the ASA because I have a fatpipe for load balancing outside the asa and a web filter.

Re: Cannot get Alias or Static NAT inside to work

jburk — Thu, 06 Aug 2009 03:47:47 GMT

it wont take

nat (inside) 1 0 0

says 'duplicate nat entry'

Re: Cannot get Alias or Static NAT inside to work

jburk — Fri, 07 Aug 2009 15:32:35 GMT

ok so I solved it, just created an access list permitting ip to that server, then natted the pool 1 to that acl, works fine

thanks for all the help