topic Re: Static Nat in Network Security

Static Nat

sureshkumar — Mon, 11 Mar 2019 12:07:36 GMT

Hi,

ISP--R1--Firewall--R2--R3--Pc(webserver)

ISP is terminated in the R1 router.To provide internet for users, Dynamic NATing are given in the rotuer(R1) level itself.R1 F0 ip is primary public ip and Secondary ip is private ip which is terminated in the Firewall interface(Private ip)..Now i need to privide Static Nat for my webserver.Is it possible to do it in Firewall..I think we can't....i have to do only in the router..

Re: Static Nat

abinjola — Sat, 23 Feb 2008 14:40:43 GMT

well the public ip address would be translated on router to firewall interface ip/or any other free ip from that pool and then on firewall we need

static (inside,outside) tcp interface/ip 80 80

access-l abc permit tcp any host interface eq 80

access-g abc in interface outside

Re: Static Nat

sureshkumar — Mon, 25 Feb 2008 06:19:41 GMT

Hi,

Always u r response very helpfull for me.Thanks again and again.So As per my senario i require 2 public ip's to do Nat in firewall(1 firewall interface and 1 for Static Nat)..But i have one free ip only..So i did Static Nat in router level itself..Let me explain my problem

My firewall is in Data center(DC)..Webserver is in branch as i said in the diagram.If i place in the webserver in DC i can access from outside..but if i place the webserver in branch(R3 router) i m unable to access from outside(getting connections in firewall(saAB))..I think some routing issue..As per current setup we have route in router to connect DC network.I think we have to add route in router like the request from internet need to go to outside(Kindly let me know the route)..Provide me ur valuable information

Re: Static Nat

sureshkumar — Mon, 25 Feb 2008 13:14:17 GMT

Hi,

Kindly provide me solution as soon.

Re: Static Nat

abinjola — Mon, 25 Feb 2008 14:52:04 GMT

you don't need 2 free IPs..you can do static PAT using firewalls outside IP

Re: Static Nat

sureshkumar — Mon, 25 Feb 2008 15:29:19 GMT

Thanks..As per now i can't change interface ip of firewall.so i did already in router..but unable to access from outside..some routing issues are there still..Can u plz help me out..

Re: Static Nat

abinjola — Mon, 25 Feb 2008 15:36:54 GMT

to what ip address is router translating the request to ?

Give me the sh run static/sh static output, sh run access-group

Re: Static Nat

sureshkumar — Tue, 26 Feb 2008 07:34:18 GMT

Hi,

Pix Fw(535)--3 interface(inside, outside, branch)

3 Routers(R1,R2 and R3)

Webserver--in brach(R3)

In beteween R2 and R3---OSPF--Is there anything need to add?

R1--NAT, PAT and routes( Default towards Serial int, Network based towards Firewall Int)

Pix--(Acl from out to in, Default route towards outside, network routes towards branch and inside, nonat for translation in higher Security interface)

If i access from outside to webserver i m finding conn in firewall( conn status : saAB)..Even i m finding the outsid world ip in my webserver log also..Some return traffic flow is not happening..

Re: Static Nat

sureshkumar — Tue, 26 Feb 2008 12:16:18 GMT

Hi,

In R1

#sh run | incl static

Ip nat outside static 172.x.x.x 203.x.x.x

Rest of the things unable to do.

Re: Static Nat

abinjola — Tue, 26 Feb 2008 12:54:32 GMT

Suresh..as a test allow icmp through the firewall and ping the web server, also can you ping the webserver from the firewall..?

Can you tell me the real ip address of the web server ? if possible post your config here

Re: Static Nat

sureshkumar — Tue, 26 Feb 2008 14:31:59 GMT

Hi,

Thanks u very much..Kindly find the attached file..In my client place i m taking care only Pix..rest of the router parts all taking care by other vendor..Static Nat is in router level..let me know the router level routes and verify the PIX config also..If i try to access from outside i m finding conn status(saAB)..

TCP out 123.176.41.235:4579 in 172.24.248.178:443 idle 0:01:14 Bytes 0 flags SaAB

TCP out 123.176.41.235:4580 in 172.24.248.178:443 idle 0:00:43 Bytes 0 flags SaAB

TCP out 123.176.41.235:4581 in 172.24.248.178:443 idle 0:00:14 Bytes 0 flags SaAB

I m finding the public ip(123.176.41.235) in websever log also..I think return traffic is not flowing.....

Re: Static Nat

sureshkumar — Tue, 26 Feb 2008 14:37:03 GMT

Hi,

kindly ignore the previous post..attachment is not there

TCP out 123.176.41.235:4579 in 172.24.248.178:443 idle 0:01:14 Bytes 0 flags SaAB

TCP out 123.176.41.235:4580 in 172.24.248.178:443 idle 0:00:43 Bytes 0 flags SaAB

TCP out 123.176.41.235:4581 in 172.24.248.178:443 idle 0:00:14 Bytes 0 flags SaAB

I m finding the public ip(123.176.41.235) in websever log also..I think return traffic is not flowing.....

Attachment Keywords :

Re: Static Nat

abinjola — Tue, 26 Feb 2008 15:59:11 GMT

config looks good...are we able to ping the webserver from the firewall ?

can you get me sh ip route from both r2 and r3 ?

Re: Static Nat

sureshkumar — Wed, 27 Feb 2008 05:36:59 GMT

Hi,

Unable to ping the webserver from firewall..

But i can ping R3 router from R1 and from R1 to R3...

Kindly find the atached file R2 ad R3...In R3 no static routes..as i said before OSPF..

Re: Static Nat

abinjola — Wed, 27 Feb 2008 12:16:50 GMT

from webserver can you ping R1..?

run debug icmp trace on firewall while you initiate a ping from webserver to R1 and 4.2.2.2 simultaneously

Re: Static Nat

sureshkumar — Wed, 27 Feb 2008 12:20:42 GMT

Hi,

Yes..I can...Is there any issues with the routes in router R1 and R2..

Re: Static Nat

abinjola — Wed, 27 Feb 2008 12:28:19 GMT

hey Suresh..the connection detail TCP out 123.176.41.235:4579 in 172.24.248.178:443 idle 0:01:14 Bytes 0 flags SaAB, clearly indicate that there was no return synack on the firewall back from web server, so either the issue is on WEBSERVER or R2 or R2

Now from WEBserver are you able to ping 4.2.2.2 through the firewall ? do you see these ICMPs request and replies in debug icmp trace ?

I don't see a DG on R2..??how would R2 know where to send the return packet ...

Re: Static Nat

sureshkumar — Fri, 29 Feb 2008 10:41:14 GMT

Hi,

After once added route in R2..we got the connectivity...Thanks for ur support..