topic Re: Cisco ASA 5520 PAT Rule Not Working in Network Security

Cisco ASA 5520 PAT Rule Not Working

Redrobin — Fri, 21 Feb 2020 15:52:52 GMT

Hi Support,

I am having problems applying a PAT rule on a ASA 5520 8.2 ASDM 6.1 ( I am aware it needs upgrading).

I am basically trying to translate outside connections into a web server using 4443 to redirect to 443 to server 192.168.1.1 (Staff-Argon).

Below is what I have setup;

static (3-Staff,0-outside) tcp interface 4443 Staff-Argon https netmask 255.255.255.255

access-list 0-outside_access_in extended permit tcp any host Staff-Argon eq https

On a packet trace it failed at NAT and telnet test faills to the external facing IP address on port 4443.

Got a bit stuck now and I am going in circles so any assistance is greatly appreciated.

Many thanks,

David

Re: Cisco ASA 5520 PAT Rule Not Working

Daniele Giordano — Thu, 14 Jun 2018 10:15:24 GMT

Try this:

conf t

object network Staff-Argon

host 192.168.1.1 (must be the private ip of your server)

nat (3-Staff,0-outside) static interface service tcp 443 4443

access-list 0-outside_access_in extended permit tcp any host 192.168.1.1 eq https

Shoud work.

Regards.

Re: Cisco ASA 5520 PAT Rule Not Working

Dennis Mink — Thu, 14 Jun 2018 14:08:51 GMT

open the outside if. up for 4443 instead of 443

Re: Cisco ASA 5520 PAT Rule Not Working

Redrobin — Thu, 14 Jun 2018 16:52:14 GMT

Hi Daniele,

Most of these commands are not support on the asa version I am running unfortunately.

Re: Cisco ASA 5520 PAT Rule Not Working

Redrobin — Thu, 14 Jun 2018 16:55:30 GMT

Hi Dennis,

Did you mean in the PAT rule or the ACL?

Thanks,

David

Re: Cisco ASA 5520 PAT Rule Not Working

Daniele Giordano — Thu, 14 Jun 2018 17:21:00 GMT

add show version please

Re: Cisco ASA 5520 PAT Rule Not Working

Florin Barhala — Thu, 14 Jun 2018 19:40:44 GMT

Hi David,

Your original config is correct but the ACL: prior to 8.3 on the outside (in direction ACL) you need to allow access on 4443 on the public IP of the outside interface rather than the private IP:443.

Re: Cisco ASA 5520 PAT Rule Not Working

Redrobin — Mon, 18 Jun 2018 11:08:07 GMT

Thanks Florin, this worked perfectly your a life saver.

Thanks to everyone else also for your comments.