ASA 8.4 NAT port forwarding

[Sheraz.Salim]

hi kindly please help and put light on this please as i could not understad why this is not working.

we have one inside interface and one outside interface no DMZ.

we want our internal webserver http can be accessable from outside but this is not happening. kindly please advise what i am missing here.

access-list outside_access_in line 1 extended permit tcp any object WWW-SERVER (hitcnt=0) 0x824735f5

object network INSIDE-SUBNET
subnet 192.168.30.0 255.255.255.0
object network WWW-SERVER
host 192.168.30.10

object network INSIDE-SUBNET
nat (inside,outside) dynamic interface

object network WWW-SERVER
nat (inside,outside) static interface service tcp 80 80

access-list Outside_access_in extended permit tcp any object WWW-SERVER eq 80
access-group Outside_access_in in interface Outside

[Philip D'Ath]

The config above is correct.

Is the web server definitely responding internally?  Can you browse to http://192.168.30.10/ ?

Is the web server able to access the Internet ok (to provide its routing and the return path is correct)?

Do you have any "http redirect ..." redirect lines in the config?

If you use the packet capture wizard do you see any TCP SYN's hitting the firewall at all?  Anything interesting in the ASA logs?

[Karsten Iwen]

1. Is that all NAT-config you have? Or are there more NAT-lines in the config?
2. What is the output of the following command:

packet-tracer input outside tcp 1.2.3.4 1234 YOUR-PUBLIC-IP 80

[Sheraz.Salim]

Hello Karsten.

no other NAT rules in config.

packet-tracer input outside tcp 81.45.24.4 1500 192.168.30.1$

Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   192.168.30.0    255.255.255.0   inside-network

Phase: 2
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group outside_access_in in interface outside
access-list outside_access_in extended permit tcp any object WWW-SERVER eq www
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0xbcc34478, priority=13, domain=permit, deny=false
        hits=6, user_data=0xb9466bc0, cs_id=0x0, use_real_addr, flags=0x0, protocol=6
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0
        dst ip/id=192.168.30.10, mask=255.255.255.255, port=80, dscp=0x0
        input_ifc=outside, output_ifc=any

Phase: 3
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0xbc15ab68, priority=0, domain=inspect-ip-options, deny=true
        hits=902, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
        input_ifc=outside, output_ifc=any

Phase: 4
Type: NAT
Subtype: rpf-check
Result: DROP
Config:
object network inside
 nat (inside-network,outside) dynamic interface
Additional Information:
 Forward Flow based lookup yields rule:
 out id=0xbc1aa4e8, priority=6, domain=nat-reverse, deny=false
        hits=18, user_data=0xbc1a8b58, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0
        dst ip/id=192.168.30.0, mask=255.255.255.0, port=0, dscp=0x0
        input_ifc=outside, output_ifc=inside-network

Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: inside-network
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

[Karsten Iwen]

wrong command. Exactly as mentioned above, only replace YOUR-PUBLIC-IP with your public IP as used on the outside interface.

And what is the output of the following command:

ping tcp 192.168.30.10 80

[Sheraz.Salim]

hi this time i did putting my public interface outside the asa

packet-tracer input outside tcp 81.45.24.4 1500 xx.xx.xx.xx 80 det$

Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   xx.xx.xx.xx   255.255.255.255 identity

Phase: 2
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0xbc1574e0, priority=0, domain=permit, deny=true
        hits=664, user_data=0x9, cs_id=0x0, use_real_addr, flags=0x1000, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
        input_ifc=outside, output_ifc=any

Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: NP Identity Ifc
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

ping tcp 192.168.30.10 80 from ASA is sucessful.

[Karsten Iwen]

You NAT is not working properly. Change the config in the following way and try again:

object network INSIDE-SUBNET
  no nat (inside,outside) dynamic interface
nat (inside,outside) after-auto source dynamic INSIDE-SUBNET interface

1. What is the output of "show nat detail"?
2. What is the IP address 81.45.24.4? Is the address anyhow related to your setup?