Hello,
So I am trying to set up a simple connection from a trusted external IP to internal server. I currently have a NAT rule on both of our Firepowers. From what I can tell the NAT rules are working fine because when attempting to connect I do see my connections coming in they just keep getting blocked and I can not find out why. I did a packet trace and it is telling me that it is blocked by default rule. Which tells me that the rule did not match however I believe I set up the rules correctly for Out to in. I would appreciate any guidance as i am new to Cisco FMC/firepowers.
These are bogus ip for security reasons but just to give a picture of the setup
External IP NAT'd for the SSH Server Firepower (North Location): 180.168.104.15
External IP NAT'd for the SSH Server Firepower (South Location): 180.168.105.15
Internal IP of SSH Server: 10.0.0.168
So in the Access Control policy of Firepower(North and South):
- Zones
- WAN
- Inside-Global-Zone
- Networks
- Source: Outside Vendor IPs (Containing a group of Host IPs)
- Destination: Internal Host IP: 10.0.0.168
- Ports for testing right now I have set Any for both source and dest
- Action: Allow
I also added in the reverse order Inside to outside policy as well to allow any ports to that ip from that internal address. Of course only for testing purposes eventually will lock down to needed ports.
However it always seems to block the incoming connection.
Phase: 1
Type: INPUT-ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
Found next-hop 00.00.00.00 using egress ifc Inside(vrfid:0)
Phase: 2
Type: ECMP load balancing
Subtype:
Result: ALLOW
Config:
Additional Information:
ECMP load balancing
Found next-hop 00.00.00.00 using egress ifc WAN(vrfid:0)
Phase: 3
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group CSM_FW_ACL_ global
access-list CSM_FW_ACL_ advanced permit ip ifc WAN any ifc Inside any rule-id 268435118
access-list CSM_FW_ACL_ remark rule-id 268435118: ACCESS POLICY: AccessPolicy - Mandatory
access-list CSM_FW_ACL_ remark rule-id 268435118: L7 RULE: GeoBlock-Inbound
Additional Information:
This packet will be sent to snort for additional processing where a verdict will be reached
Phase: 4
Type: CONN-SETTINGS
Subtype:
Result: ALLOW
Config:
class-map class-default
match any
policy-map global_policy
class class-default
set connection advanced-options UM_STATIC_TCP_MAP
service-policy global_policy global
Additional Information:
Phase: 5
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
Phase: 6
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Phase: 7
Type: VPN
Subtype: ipsec-tunnel-flow
Result: ALLOW
Config:
Additional Information:
Phase: 8
Type: NAT
Subtype: rpf-check
Result: DROP
Config:
nat (Inside,WAN) source static SSHServer SSHServer_ExternalNAT
Additional Information:
Result:
input-interface: WAN(vrfid:0)
input-status: up
input-line-status: up
output-interface: Inside(vrfid:0)
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule, Drop-location: frame 0x00005626461aa854 flow (NA)/NA
Accepted Solutions
