Asa nat error

[opnineopnine]

Hi all,

I have a asa 5505 and im having the following error.

nat (inside) 0 access-list inside_nat0_outbound 
ERROR: access-list has protocol or port

Any ideas?

[burleyman]

Please post the ACL inside_nat0_outbound

[opnineopnine]

Hello burleyman

access-list inside_nat0_outbound extended permit ip any host estudio_address 
access-list inside_nat0_outbound extended permit ip any 172.18.3.0 255.255.255.0 
access-list inside_nat0_outbound extended permit ip 172.17.2.0 255.255.255.0 host 10.61.10.224 
access-list inside_nat0_outbound extended permit ip any 12.100.64.0 255.255.255.0 
access-list inside_nat0_outbound extended permit ip any 12.100.65.0 255.255.255.0 
access-list inside_nat0_outbound extended permit ip any 12.102.0.0 255.255.255.0 
access-list inside_nat0_outbound extended permit ip any 12.100.66.0 255.255.255.0 
access-list inside_nat0_outbound extended permit tcp any 12.100.64.0 255.255.255.0 eq www --this is the last one i added.

[Karsten Iwen]

An ACL that is used for NAT exemption should not contain any ports. If you really need ports (based on your config, I don't think so), you have to configure static identity NAT.

Just use the following line instead of your last line:

access-list inside_nat0_outbound extended permit ip any 12.100.64.0 255.255.255.0

[opnineopnine]

Hello Karsten

To fix the issue i would have to erase the acl and add the nat, write?

no access-list inside_nat0_outbound extended permit tcp any 12.100.64.0 255.255.255.0 eq www

 nat (inside) 0 access-list inside_nat0_outbound

Thanks.

[Karsten Iwen · Accepted solution]

Yes, remove the line with the port and add the same line without ports and with ip instead of tcp. That's all that has to be done..

[opnineopnine]

I found my own error

 no access-list inside_nat0_outbound extended permit tcp any 12.100.64.0 255.255.255.0 eq www

 nat (inside) 0 access-list inside_nat0_outbound

Is that correct?