Hello,
This is my first time posting to the Support Community, and I'm hoping some folks with more insight into the "new" NAT structures in post 8.3 can shed some light on what's going wrong with this strange configuration that's been requested of me...
Our sysadmins are decommissioning DNS zones for domains which we are not authoratative for. I understand that this is a good idea. DNS requests now go to an authoratative server via the internet, so instead of allowing direct internal communications to the webservers via our DNS and RFC1918 addressing, the communication now must route to the public (global) IP associated with our hosted webserver.
The initial problem is that we were routing everything through a Websense proxy to the internet, and that traffic was all PAT'd to the outside interface IP of 200.1.1.254 (scrubbed). If traffic would try to re-enter via the existing static NAT to the webserver (200.1.1.88 >> 192.168.2.188), I'd get denies via an IP spoof error. I determined to try PAT'ing this traffic to a new PAT IP using Twice NAT to identify the particular communication.
My configuration is below.
! Cisco Adaptive Security Appliance Software Version 9.0(x)
!
!
interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 200.1.1.254 255.255.255.0 standby 200.1.1.253
!
interface GigabitEthernet0/1
nameif dmz1
security-level 41
ip address 192.168.1.254 255.255.255.0 standby 192.168.1.253
!
interface GigabitEthernet0/2
nameif dmz2
security-level 43
ip address 192.168.2.254 255.255.255.0 standby 192.168.2.253
!
interface GigabitEthernet0/3
nameif inside
security-level 100
ip address 172.22.16.254 255.240.0.0 standby 172.22.16.253
!
!
!
object network obj-src-real
subnet 192.168.1.0 255.255.255.0
!
object network obj-src-nat
host 200.1.1.200
!
object network obj-dst-webserver-nat
host 200.1.1.88
!
object network obj-dst-webserver-real
host 192.168.2.188
!
!
!
object-group PROXY-SERVERS
description Network Proxy Servers
network-object host 192.168.1.36
!
!
!
route outside 0.0.0.0 0.0.0.0 201.1.1.1
!
!
!
access-group dmz1 in interface dmz1
!
access-group outside in interface outside
!
access-list dmz1 extended permit ip object-group PROXY-SERVERS any4
!
access-list outside extended permit tcp any4 host 192.168.2.188 eq https
!
!
!
object network obj-dst-webserver-real
nat (dmz2,outside) static 200.1.1.88
!
object network obj-src-real
nat (dmz1,outside) dynamic interface
!
nat (dmz1,outside) source dynamic obj-src-real obj-src-nat destination static obj-dst-webserver-nat obj-dst-webserver-nat
!
The twice NAT is perplexing to me, as I can only get an xlate if I specify the mapped (outside) address twice in the destination portion of the syntax. I do not know if this is correct. I see the xlate build, no denies on the firewall, and the connections table on the firewall using the mapped (outside address) indicates a three-way handshake (saA flags), but no data passes.
The proxy logs indicate the same 504 "bad gateway" errors that I've been struggling with since the beginning.
I've attached packet traces and a diagram for reference. If anyone can help me make some sense of this, I'd be very happy. Thanks in advance.
