02-08-2017 07:53 AM - edited 03-12-2019 01:54 AM
Good afternoon, I have an ASA 5506 I'm having difficulty redirecting the public ip 200,188,213,171 ----> to get the IP address at 172.18.37.11:8080 that our Cameras nvr and get external access in the browser by typing;
Http://200.188.213.171:8080 Help?
Solved! Go to Solution.
02-08-2017 08:46 AM
Hello,
You will need a NAT for translation, example:
object network NVR-172.18.37.11
nat (inside,outside) static 200.188.213.171 service tcp 8080 8080
02-08-2017 08:46 AM
Hello,
You will need a NAT for translation, example:
object network NVR-172.18.37.11
nat (inside,outside) static 200.188.213.171 service tcp 8080 8080
02-08-2017 08:58 AM
I tried this setting but it gives me an error
FW001(config-network-object)# nat (inside,outside) static 200.188.213.171 ser$
ERROR: empty object/object-group(s) detected. NAT Policy is not downloaded
02-08-2017 09:12 AM
Sorry, the network object will need to be created first:
object network NVR-172.18.37.11
host 172.18.37.11
Then add the NAT.
You may also need to add an entry on your ACL that is applied to the outside interface to allow the traffic in from the outside. Are you wanting to allow it from anywhere, or lock it down to a specific Public IP? Do you have an existing ACL applied to the outside interface?
run the command:
show run access-group
Is there an ACL applied to the outside interface?
02-08-2017 09:24 AM
Show
FW001# conf t
FW001(config)# show ru
FW001(config)# show running-config obje
FW001(config)# show running-config object
object network NAT-LAN
subnet 172.18.37.0 255.255.255.0
object network NVR-172.18.37.11
FW001(config)# nat (inside,outside) static 200.188.213.171 service tcp 8080 8080
ERROR: empty object/object-group(s) detected. NAT Policy is not downloaded
I created the object but when I go to add nat it generates an error is not downloade
You do not have the access group
02-08-2017 09:32 AM
It looks like the network object is still not created, it says its empty. Do this first:
object network NVR-172.18.37.11
host 172.18.37.11
After that host entry is added in the network object, you can add the NAT
02-08-2017 09:41 AM
You experienced the same error. This is the start configuration show run of the wing
FW001# show run
FW001# show running-config
: Saved
:
: Serial Number: JAD193400NV
: Hardware: ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cor es)
:
ASA Version 9.5(2)6
!
hostname FW001
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface GigabitEthernet1/1
nameif inside
security-level 100
ip address 172.18.37.254 255.255.255.0
!
interface GigabitEthernet1/2
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/3
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/4
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/5
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/6
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/7
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/8
nameif outside
security-level 0
ip address 200.188.213.171 255.255.255.0
!
interface Management1/1
management-only
shutdown
no nameif
no security-level
no ip address
!
ftp mode passive
object network NAT-LAN
subnet 172.18.37.0 255.255.255.0
object network NVR-172.18.37.11
host 172.18.37.11
pager lines 24
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
!
object network NAT-LAN
nat (inside,outside) dynamic interface
route outside 0.0.0.0 0.0.0.0 200.188.213.169 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
user-identity default-domain LOCAL
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
dynamic-access-policy-record DfltAccessPolicy
!
!
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:d98b97903fb93b1552e51cbaa39336b1
: end
FW001#
02-08-2017 09:45 AM
ERROR: NAT Policy is not downloaded
Also there is no in-use NAT entry for this IP...
fw-01(config)# sh nat 200.188.213.171 detail
No matching NAT policy found
02-08-2017 09:48 AM
Thanks for the config. See if the following works:
object network NVR-172.18.37.11
nat (inside,outside) static interface service tcp 8080 8080
02-08-2017 09:55 AM
Now there was no error
object network NAT-LAN
nat (inside,outside) dynamic interface
object network NVR-172.18.37.11
nat (inside,outside) static interface service tcp 8080 8080
route outside 0.0.0.0 0.0.0.0 200.188.213.169 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
user-identity default-domain LOCAL
no snmp-server location
Your add the line
Access-list NVR1 allow tcp any host 172.18.37.11 eq 8080 8080
It will be possible to access from a browser http://200.188.213.171:8080
02-08-2017 10:01 AM
It tested but did not open login screen without browser
Access-list NVR1 allow tcp any host 172.18.37.11 eq 8080
n my internal network this ip 172.18.37.11:8080 is of the NVR and I want to access defora here in not typing in the browser http://200.188.213.171:8080
02-08-2017 10:04 AM
Have to apply your new NVR1 ACL to access-group on outside interface now:
access-group NVR1 in interface outside
02-08-2017 10:25 AM
Sorry, I do not understand, can you add me an example please?
02-08-2017 10:33 AM
conf t
access-group NVR1 in interface outside
02-08-2017 10:43 AM
Ah I added this line but it did not work
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide