topic Re: NAT problems on ASA5500 in Network Security

NAT problems on ASA5500

itadmin — Mon, 11 Mar 2019 13:15:47 GMT

Hi all,

Help for a newbie please.

I have a problem with the inside network accessing web servers in the DMZ. I am getting portmap translation fail errors, however I need help with the command to allow all inside hosts access to the DMZ. It's a new firewall and I donot have to configure these often so my skills are limited.

I think I need to add the following commands:

nat (dmz) 1 192.168.200.0 255.255.255.0

access-group dmz_access_in in interface dmz

...and then appropriate ACLs

Current config as follows (some of the config suppressed):

ASA Version 7.1(2)

interface Ethernet0/0

nameif outside

security-level 0

ip address 222.222.222.74 255.255.255.248

interface Ethernet0/1

nameif inside

security-level 100

ip address 192.168.203.1 255.255.255.0

interface Ethernet0/2

nameif dmz

security-level 50

ip address 192.168.200.1 255.255.255.0

access-list inside_access_in extended permit tcp any any

access-list inside_access_in extended permit udp any any

access-list inside_access_in extended permit icmp any any

access-list outside_access_in extended permit tcp any host 222.222.222.75 eq smtp

access-list outside_access_in extended permit tcp any host 222.222.222.75 eq https

access-list outside_access_in extended permit tcp any host 222.222.222.75 eq pop3

access-list outside_access_in extended permit tcp any host 222.222.222.75 eq imap4

access-list outside_access_in extended permit tcp any host 222.222.222.78 eq www

access-list outside_access_in extended permit tcp any host 222.222.222.78 eq ftp

access-list outside_access_in extended permit tcp any host 222.222.222.77 eq www

access-list outside_access_in extended permit tcp any host 222.222.222.77 eq ftp

access-list outside_access_in extended permit tcp any host 222.222.222.75 eq www

access-list outside_access_in extended permit udp any host 222.222.222.78 eq domain

access-list outside_access_in extended permit tcp any host 222.222.222.78 eq domain

nat-control

global (outside) 1 interface

nat (inside) 0 access-list inside_nat0_outbound

nat (inside) 1 192.168.203.0 255.255.255.0

static (inside,outside) tcp 222.222.222.75 smtp 192.168.203.21 smtp netmask 255.255.255.255

static (inside,outside) tcp 222.222.222.75 https 192.168.203.21 https netmask 255.255.255.255

static (inside,outside) tcp 222.222.222.75 imap4 192.168.203.21 imap4 netmask 255.255.255.255

static (inside,outside) tcp 222.222.222.75 pop3 192.168.203.21 pop3 netmask 255.255.255.255

static (inside,outside) tcp 222.222.222.78 www 192.168.203.2 www netmask 255.255.255.255

static (inside,outside) tcp 222.222.222.78 ftp 192.168.203.2 ftp netmask 255.255.255.255

static (inside,outside) tcp 222.222.222.75 www 192.168.203.201 www netmask 255.255.255.255

static (inside,outside) tcp 222.222.222.77 www 192.168.203.200 www netmask 255.255.255.255

static (inside,outside) tcp 222.222.222.77 ftp 192.168.203.200 ftp netmask 255.255.255.255

static (inside,outside) tcp 222.222.222.78 domain 192.168.203.200 domain netmask 255.255.255.255

static (inside,outside) udp 222.222.222.78 domain 192.168.203.200 domain netmask 255.255.255.255

access-group outside_access_in in interface outside

access-group inside_access_in in interface inside

route outside 0.0.0.0 0.0.0.0 222.222.222.73 1

Re: NAT problems on ASA5500

dhananjoy chowdhury — Thu, 17 Jul 2008 04:52:40 GMT

Hi,

Is there any specific reason you are using "nat-control" because by default it should be "no nat-control".

if you do "no nat-control" you can access your DMZ without any other NAT statements.

Re: NAT problems on ASA5500

itadmin — Thu, 17 Jul 2008 04:54:22 GMT

To be honest I am not sure what nat-control does exactly so no there is no specific reason for using nat-control.

What are the implications removing this command?

Re: NAT problems on ASA5500

dhananjoy chowdhury — Thu, 17 Jul 2008 05:03:16 GMT

What nat-control does is, it will work as old PIX systems , it specifies that all traffic passing through the firewall must have a specific NAT entry.

Re: NAT problems on ASA5500

itadmin — Thu, 17 Jul 2008 05:37:04 GMT

Thanks for your help, I have changed the config as per below. I have a host at address 192.168.200.2/24 in the dmz.

For it to access inside addresses do I need to add individual nat entries for each server it accesses?

Also the inside network can not access this host even after the changes?