ASA 9.1 Access-list , real IP addresses

[DannyHuston]

So in the past from 8.2 down I had one to one NATs like so

static (inside,outside) A.A.A.A B.B.B.B netmask 255.255.255.255

but for 9.1 im running now I need to do this

object network obj-B.B.B.B

  host B.B.B.B

  nat (inside,outside) static A.A.A.A

So if I make an ACL to permit outside public access to the public IP (A.A.A.A) in 9.1 do I use real B.B.B.B ip address or the object itself obj-B.B.B.B?

[Jouni Forss]

Hi,

Yes, thats pretty much it.

You always make the rules using the Real IP address. I tend to use the "object" in the ACLs. In certain situations I might group several "object" under an "object-group" and use the "object-group"

This way of creating rules is basicly because the ACL and NAT are gone through in different order compared to the "older" softwares.

- Jouni

[DannyHuston]

Ok just to confirm I do

access-list outside_access_in_1 extended permit tcp any object obj-B.B.B.B

or

access-list outside_access_in_1 extended permit tcp any object B.B.B.B


Either one will work?  Even if the access is meant to go to its public NAT A.A.A.A

[Jouni Forss · Accepted solution]

Hi,

For example

object network SERVER

host 10.10.10.10

nat (inside,outside) static 1.2.3.4

access-list OUTSIDE-IN permit tcp any object SERVER eq www

OR

access-list OUTSIDE-IN permit tcp any host 10.10.10.10 eq www

Where

• SERVER = Name of the object under which the Real IP and its NAT is defined
• 10.10.10.10 = Real IP of the server
• 1.2.3.4 = Public (NAT) IP of the server

So you always open the port/service to the Real IP address of the destination even if there is a NAT configured for it.

- Jouni

[DannyHuston]

Thanks!