Port Forwarding ISSUE on Cisco ASA 5545

[Shoaib-Muhammad2]

Respected All;

I have purchased Cisco ASA 5545 in which i have created sub-interface with security level 100 on inside network where as outside interface also configured with functional status. All traffic works well from inside sub-interfaces to outside.

The Problem is that when i want to port forward from outside interface to inside sub-interface firewall reject it and not forwarded the traffic to internal machine.

ALL Natting and ACL also configured fine and also compared with cisco documentation i dont know why this is happening to me.

Kindly Help Me. 

[Damien Miller]

Leveraging the packet tracer functionality could be a huge help for you here. If it is a config issue then it should indicate which step along the way is causing the drop.

[Shoaib-Muhammad2]

object service Port-forward-real
service tcp source eq 3389

object service Port-forward
service tcp destination eq 9001

nat (vl215,vlan301) source static 192.168.215.37-32 Public IP service Port-forward Port-forward-real

access-list outside extended permit ip any host 192.168.215.37

I have configured above mentioned config on firewall, How can i use packet tracer to find actual problem

[Shoaib-Muhammad2]

FW-SIBA-5545#packet-tracer input vlan301 tcp 192.168.215.37 3389 PUBLIC IP 9001

Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list

Phase: 2
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
found next-hop PUBLIC IP using egress ifc vlan301

Result:
input-interface: vlan301
input-status: up
input-line-status: up
output-interface: vlan301
output-status: up
output-line-status: up
Action: drop
Drop-reason: (nat-no-xlate-to-pat-pool) Connection to PAT address without pre-existing xlate

[Shoaib-Muhammad2]

ALL NAT Process Seems ok from Inside to outside and all traffic like internet browsing etc are working fine.

But when i will try to port forward form outside to inside its create issue

Need Expert Advice and support Please

[balaji.bandi]

I may be miss understood here, you looking to NAT from outside to inside right ?

Assuming that the server is: 192.168.215.37, and you woud like to NAT it to PUBLIC-IP.

[Shoaib-Muhammad2]

No Sir,

I need to Open 3389 Port for this machine which is 192.168.215.37

Its Port Forwarding Like Outside to Inside

[balaji.bandi]

So rule is like below

user connect to Public IP - 9001

you want to port-forward to internal IP 3389

Is this Public-IP shared or Dedicated ?

[Shoaib-Muhammad2]

Public IP is dedicated Sir

[Shoaib-Muhammad2]

Sir is it some kind of bug because i have tried a lot from last 9 days but i dont why this firewall is behaving like that