Port Forward issue- ASA 5508 version 9.8(1)

bmatson37 — Fri, 21 Feb 2020 17:00:37 GMT

Hello all-

I am attempting to forward both TCP and UDP 5081 and 5082 traffic hitting the outside interface on my ASA to an internal server at 172.16.200.10. behind the "camera" interface I've done a fair amount of reading on the topic and believe I have it configured properly but for the part where I don't actually see NAT hits. I'll provide all the information I think is relevant below and am happy to provide more should any be required. My best guess is that I have another NAT somehow interfering but I've tried disabling any that I would think may affect this traffic.

hostname # sh run nat
nat (Production,Outside) source dynamic any interface
nat (any,Camera_Management) source dynamic VPN_Clients interface
nat (any,Production) source dynamic VPN_Clients interface
nat (Cameras,Outside) source dynamic any interface
nat (any,Cameras) source dynamic VPN_Clients interface
!
object network VMS_TCP8081
nat (Cameras,Outside) static interface no-proxy-arp service tcp 8081 8081
object network VMS_UDP8081
nat (Cameras,Outside) static interface no-proxy-arp service udp 8081 8081
object network VMS_TCP8082
nat (Cameras,Outside) static interface no-proxy-arp service tcp 8082 8082
object network VMS_UDP8082
nat (Cameras,Outside) static interface no-proxy-arp service udp 8082 8082
object network Cameras_network
nat (Cameras,Outside) dynamic interface
object network VPN_Cameras
nat (any,Camera_Management) dynamic interface
object network Management_Internet
nat (Camera_Management,Outside) dynamic interface

hostname# sh run access-list
access-list Management standard permit 172.16.200.0 255.255.252.0
access-list Management standard permit 172.16.75.0 255.255.255.0
access-list Management standard permit 10.45.0.0 255.255.0.0
access-list AnyConnect_Client_Local_Print extended deny ip any4 any4
access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq lpd
access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol
access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 631
access-list AnyConnect_Client_Local_Print remark Windows' printing port
access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 9100
access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol
access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.251 eq 5353
access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol
access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.252 eq 5355
access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol
access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 137
access-list AnyConnect_Client_Local_Print extended permit udp any4 any4 eq netbios-ns
access-list Production_access_in extended permit ip object VPN_Clients any
access-list Production_access_in extended permit ip object Production any
access-list Cameras_access_in extended permit ip object VPN_Clients any
access-list Cameras_access_in extended permit ip 172.16.200.0 255.255.252.0 any
access-list Camera_Management_access_in extended permit ip object VPN_Clients interface Camera_Management
access-list Camera_Management_access_in extended permit ip 172.16.75.0 255.255.255.0 any
access-list Outside_access_in extended permit tcp any object XSMEDIA_Comcast eq ssh
access-list Outside_access_in extended permit tcp any object XSMEDIA_Comcast eq www
access-list Outside_access_in extended permit tcp any object VMS_TCP8081 eq 8081
access-list Outside_access_in extended permit tcp any object VMS_TCP8082 eq 8082
access-list Outside_access_in extended permit udp any object VMS_UDP8081 eq 8081
access-list Outside_access_in extended permit udp any object VMS_UDP8082 eq 8082
access-list Outside_access_in extended permit tcp any interface Outside eq 8082
access-list outside-inbound extended permit tcp any object VMS_TCP8081 eq 8081
access-list outside-inbound extended permit udp any object VMS_UDP8081 eq 8081
access-list outside-inbound extended permit tcp any object VMS_TCP8082 eq 8082
access-list outside-inbound extended permit udp any object VMS_UDP8082 eq 8082
access-list Local_Lan_Access standard permit host 0.0.0.0

hostname# sh nat
Manual NAT Policies (Section 1)
1 (Production) to (Outside) source dynamic any interface
translate_hits = 98291, untranslate_hits = 561
2 (any) to (Camera_Management) source dynamic VPN_Clients interface
translate_hits = 19, untranslate_hits = 1
3 (any) to (Production) source dynamic VPN_Clients interface
translate_hits = 195, untranslate_hits = 6
4 (Cameras) to (Outside) source dynamic any interface
translate_hits = 216, untranslate_hits = 19
5 (any) to (Cameras) source dynamic VPN_Clients interface
translate_hits = 185, untranslate_hits = 0

Auto NAT Policies (Section 2)
1 (Cameras) to (Outside) source static VMS_TCP8081 interface service tcp 8081 8081 no-proxy-arp
translate_hits = 0, untranslate_hits = 0
2 (Cameras) to (Outside) source static VMS_TCP8082 interface service tcp 8082 8082 no-proxy-arp
translate_hits = 0, untranslate_hits = 0
3 (Cameras) to (Outside) source static VMS_UDP8081 interface service udp 8081 8081 no-proxy-arp
translate_hits = 0, untranslate_hits = 0
4 (Cameras) to (Outside) source static VMS_UDP8082 interface service udp 8082 8082 no-proxy-arp
translate_hits = 0, untranslate_hits = 0
5 (Outside) to (Camera_Management) source static _vpn_nat_172.16.249.2 71.236.243.113
translate_hits = 0, untranslate_hits = 0
6 (Outside) to (Camera_Management) source static _vpn_nat_172.16.249.5 71.236.243.113
translate_hits = 0, untranslate_hits = 0
7 (Outside) to (Camera_Management) source static _vpn_nat_172.16.249.7 140.211.82.4
translate_hits = 0, untranslate_hits = 0
8 (Camera_Management) to (Outside) source dynamic Management_Internet interface
translate_hits = 7127, untranslate_hits = 52
9 (any) to (Camera_Management) source dynamic VPN_Cameras interface
translate_hits = 0, untranslate_hits = 0
10 (Cameras) to (Outside) source dynamic Cameras_network interface
translate_hits = 842, untranslate_hits = 23

hostname# packet-tracer input outside tcp 1.2.3.4 12345 X.X.X.X (public IP) 8082 detailed

Phase: 1
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
found next-hop 199.66.196.254 using egress ifc identity

Phase: 2
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x2aaac927e600, priority=1, domain=nat-per-session, deny=true
hits=715215, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=6
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
input_ifc=any, output_ifc=any

Phase: 3
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0x2aaad9015390, priority=0, domain=permit, deny=true
hits=579864, user_data=0xa, cs_id=0x0, use_real_addr, flags=0x1000, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
input_ifc=Outside, output_ifc=any

Result:
input-interface: Outside
input-status: up
input-line-status: up
output-interface: NP Identity Ifc
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

Any assistance is very much appreciated. It's clear that I'm overlooking something obvious but I'm sort of stuck.

Re: Port Forward issue- ASA 5508 version 9.8(1)

bmatson37 — Thu, 04 Apr 2019 19:42:24 GMT

So I've figured it out myself but I'm not completely certain why it fixed it.

I removed all of the NAT statements from the top section here

$hostname# sh run nat
nat (Production,Outside) source dynamic any interface
nat (any,Camera_Management) source dynamic VPN_Clients interface
nat (any,Production) source dynamic VPN_Clients interface
nat (Cameras,Outside) source dynamic any interface
nat (any,Cameras) source dynamic VPN_Clients interface
!
object network VMS_TCP8081
nat (Cameras,Outside) static interface no-proxy-arp service tcp 8081 8081
object network VMS_UDP8081
nat (Cameras,Outside) static interface no-proxy-arp service udp 8081 8081
object network VMS_TCP8082
nat (Cameras,Outside) static interface no-proxy-arp service tcp 8082 8082
object network VMS_UDP8082
nat (Cameras,Outside) static interface no-proxy-arp service udp 8082 8082
object network Cameras_network
nat (Cameras,Outside) dynamic interface
object network VPN_Cameras
nat (any,Camera_Management) dynamic interface
object network Management_Internet
nat (Camera_Management,Outside) dynamic interface

I then re-input them with the "after-auto" command input in the middle - for example:

nat (Production,Outside) after-auto source dynamic any interface
nat (any,Production) after-auto source dynamic VPN_Clients interface

My thought had been that the port forward wasn't working because the traffic was somehow hitting something beforehand, which has proven to be true. What I do not understand is why a NAT for a different network (Production vs Cameras) would have caught this. Any insight would be appreciated.

topic Re: Port Forward issue- ASA 5508 version 9.8(1) in Network Security

Port Forward issue- ASA 5508 version 9.8(1)

Re: Port Forward issue- ASA 5508 version 9.8(1)