ASA 5540 Management interface internet access problem

[gasparmenendez]

Hello friends,

this time I have a problem with my ASA 5540. It has configured an outside interface and 3 inside interfaces. The outside interface has a public IP address and is Nating everything from inside interfaces. So far so good. My problem is that I just connect a Cable Modem to the Managemement interface and I'm trying to redirect some traffic from one of the inside interfaces through the CM. The CM has a public IP on its WAN and a private IP on its LAN (192.168.1.1). I think I need to make a NAT rule like this:

nat (CABLE,CableModem) source dynamic net10.13.0.0-16 CM

also I have:

interface Management0/0
 speed 100
 duplex full
 nameif CableModem
 security-level 30
 ip address 192.168.1.2 255.255.255.0

=============================================

object network obj-10.13.0.0
 subnet 10.13.0.0 255.255.0.0

=============================================

object network CM
 host 192.168.1.4

I don't know what I'm missing here. I've been trying for several days and several solutions but there's no possible way for me to do this. Can anybody helpme please??? At this point I'm very desperate. If something else is need it please let me know. Thank you very much in advance.

BR.

[Karsten Iwen]

The first important thing to consider is, that the legacy 5540 can't do Policy-Based-Routing. You have to control with static routes which destinations should be reached through this line.

You need a static route with higher AD pointing to the CM next-hop.

For NAT, I wouldn't NAT on the ASA. Better configure a static route for the internal networks on the cable-modem and use the NAT/PAT that is done there.

[gasparmenendez]

Thanks for your answer Karsten. Maybe I didn't make my self clear. Sorry for that and sorry for my English.

Network 10.13.0.0/16 is for CMTS with almost 1000 clients, so I need to do NAT on ASA. Right now I have that network accesing to internet just fine, but through a public IP (200.X.X.152) in the outside interface:

nat (CABLE,outside) source dynamic net10.13.0.0-16 ip152

What I need is that CMTS (10.13.0.0/16) reach the internet through the Management interface with the other ISP (Cable Modem) connected to it. I thought it was so simple as change the interface and the NAT ip but obviously I'm wrong.

I don't know what I'm doing wrong. Any ideas???

BR.

[Karsten Iwen]

ok, so the new exitpoint is the interface "CableModem"? Then add the default-route to the modem, remove the old route and configure the NAT as you have done above. Make sure to put the NAT-rule at the end by specifying the keyword "after-auto":

nat (CABLE,CableModem) after-auto source dynamic net10.13.0.0-16 CM

Also make sure that there are no conflicting rules above.

[gasparmenendez]

Didn't work. I'm seeing no traffic on CableModem interface.

what I don't understand is why when I set up a static ip to my lap (192.168.1.4) and connect it directly to CM I can reach the internet, but when I connect the CM to the ASA interface (192.168.1.2) and set that very same ip address (192.168.1.4) for NAT it doesn't work...

This thing is driving me crazy!!

I think I don't need to modify routes in the CM since the ASA is translating network 10.13.0.0/16 in 192.168.1.4, right???

[Karsten Iwen]

can you share the rest of your NAT- and routing-config?

[gasparmenendez]

would you like something specific?? coz the ASA has a big big configuration....it's nearly impossible copy it here. BR.

[Karsten Iwen]

At least it's very likely that the problem is NAT- or routing related.

Or after configuring it in a way that you think it should work, you can run the packet-tracer

packet-tracer input CABLE tcp ANY-ALLOWED-INTERNAL-IP 1234 1.2.3.4 80

and share the result.

[gasparmenendez]

this is the result:

PIX-COSMOCABLE# packet-tracer input CABLE tcp ANY-ALLOWED-INTERNAL-IP 1234 1.2$

packet-tracer input CABLE tcp ANY-ALLOWED-INTERNAL-IP 1234 1.2.3.4 80
                                                          ^
ERROR: % Invalid input detected at '^' marker.

it seems to be an error on the ANY-ALLOWED-INTERNAL-IP.

But I'm thinking, the CABLE interface works fine when the NAT is throuhg OUTSIDE interface. The problem is when the NAT is through CABLEMODEM interface