ASA5505 port forwarding port 22 (SSH)

[itsupport08032020]

I am wondering why I am only seeing untranslate_hits. I am trying to port forward via port 22 (ASA5505) to Cisco 2911 on port 22

Auto NAT Policies (Section 2)
1 (inside) to (outside) source static Internal_Router_Access interface service tcp ssh ssh
translate_hits = 0, untranslate_hits = 3

Here is the configuration

object network External_Router_Access
host 71.XX.XX.246
object network Internal_Router_Access
host 10.XX.XX.5

access-list outside_access_in extended permit tcp any object Internal_Router_Access eq ssh
access-list outside_access_in extended deny ip any4 any4

object network Internal_Router_Access
nat (inside,outside) static interface service tcp ssh ssh
!
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside

What am I missing here?

[Marius Gunnerud]

The translate_hits and untranslate_hits just show the hit count for new connections.  So, translate_hits will show hit counts for all new connections from the router to the internet (real IP to mapped IP), while untranslate hits will show hit counts for all new connections from devices on the internet towards the router (mapped IP to real IP).

Is there something that is not working correctly with your setup?

[itsupport08032020]

Yes port forwarding for some reason is not working as it should be. I am not seeing the translate_hits counts - so something is not working from the router to the internet. Do you see any issues in the configuration? 

[Marius Gunnerud]

Your NAT config looks fine. Are you issuimg an SSH from the router out to some other device on the internet? You did not post the inside access-list. What are you allowing in this ACL?

[itsupport08032020]

object network External_Router_Access
host 71.XX.XX.246

Here is the inside access-list:

access-list inside_access_in extended permit tcp any object External_Router_Access eq ssh
access-list inside_access_in remark Explicit Deny All
access-list inside_access_in extended deny ip any any

[Marius Gunnerud]

If you are just trying to access the External router using SSH then your configuration for NAT and access list look fine.  I am assuming you have a default route configured on the internal router? or at the very least a specific route for the External router that points to the ASA inside interface?

Would you be able to post the full running-config of the ASA, Internal router and External router (remember to remove any public IPs, usernames, and passwords.)?

[itsupport08032020]

So, I am trying to SSH (port 22) from the External_Router_Access IP to the Internal_Router_Access (Cisco 2911 - this is behind the ASA5505)

object network Internal_Router_Access
host 10.XX.XX.X
object network External_Router_Access
host 71.XX.XX.246

Here is the config (note that I have removed some network objects and VPN configurations but I have left the ip route, access rules, etc)

ASA Version 9.1(7)21
!
hostname XXXXX
domain-name XXXXX
enable password XXXXXXXXX encrypted
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain

names
name 9X.XX.XX.XX outside

!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
nameif inside
security-level 100
ip address 10.XX.XX.6 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address outside 255.255.255.0
!
boot system disk0:/asa917-21-k8.bin
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns domain-lookup inside
dns server-group DefaultDNS
name-server 10.XX.XX.XX
name-server 10.XX.XX.XX
domain-name XXXXXX

access-list outside_1_cryptomap extended permit ip object-group DM_INLINE_NETWORK_5 object-group DM_INLINE_NETWORK_3
access-list inside_nat0_outbound extended permit ip object-group DM_INLINE_NETWORK_19 object-group DM_INLINE_NETWORK_1
access-list inside_nat0_outbound extended permit ip object-group DM_INLINE_NETWORK_20 object-group DM_INLINE_NETWORK_21
access-list outside_4_cryptomap extended permit ip object-group DM_INLINE_NETWORK_10 object-group DM_INLINE_NETWORK_4
access-list outside_6_cryptomap extended permit ip object-group DM_INLINE_NETWORK_11 object-group DM_INLINE_NETWORK_12
access-list outside_7_cryptomap extended permit ip 10.XX.XX.0 255.255.255.0 10.XX.XX.96.0 255.255.255.0
access-list outside_access_in extended permit tcp any object Internal_Router_Access eq ssh
access-list outside_access_in extended deny ip any4 any4
access-list inside_nat_outbound extended permit ip 10.XX.XX.0 255.255.255.0 any4
access-list outside_cryptomap_1 extended permit ip object-group DM_INLINE_NETWORK_15 object-group DM_INLINE_NETWORK_16
access-list inside_access_in extended permit tcp any object External_Router_Access eq ssh
access-list inside_access_in remark Allow all vpn tunnel traffic
access-list inside_access_in extended permit ip object-group DM_INLINE_NETWORK_35 object-group DM_INLINE_NETWORK_36
access-list inside_access_in remark Explicit Deny All
access-list inside_access_in extended deny ip any any
pager lines 24
logging enable
logging timestamp
logging asdm informational
logging from-address XXXXXXXXXXXXXXXXX
logging recipient-address XXXXXXXXXXXXXXX level errors
logging host inside 10.XX.XX.XX
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-791.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (inside,any) source static DM_INLINE_NETWORK_19 DM_INLINE_NETWORK_19 destination static DM_INLINE_NETWORK_1 DM_INLINE_NETWORK_1 no-proxy-arp route-lookup
nat (inside,any) source static DM_INLINE_NETWORK_24 DM_INLINE_NETWORK_24 destination static DM_INLINE_NETWORK_2 DM_INLINE_NETWORK_2 no-proxy-arp route-lookup
nat (inside,any) source static DM_INLINE_NETWORK_25 DM_INLINE_NETWORK_25 destination static DM_INLINE_NETWORK_26 DM_INLINE_NETWORK_26 no-proxy-arp route-lookup
nat (inside,any) source static obj-10.XX.XX.0 obj-10.XX.XX.0 destination static obj-10.XX.XX.0 obj-10.XX.XX.0 no-proxy-arp route-lookup
nat (inside,any) source static DM_INLINE_NETWORK_29 DM_INLINE_NETWORK_29 destination static DM_INLINE_NETWORK_30 DM_INLINE_NETWORK_30 no-proxy-arp route-lookup
!
object network Internal_Router_Access
nat (inside,outside) static interface service tcp ssh ssh
!
nat (inside,outside) after-auto source dynamic obj-10.XX.XX.0 interface
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
!
router ospf 100
network 0.0.0.0 0.0.0.0 area 0
area 0
log-adj-changes
!
route outside 0.0.0.0 0.0.0.0 9X.XX.XX.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy

http server enable
http 0.0.0.0 0.0.0.0 inside
snmp-server host inside 10.XX.XX.XX community XXXXX
no snmp-server location
no snmp-server contact
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 15
ssh scopy enable
ssh stricthostkeycheck
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 15
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 0

priority-queue outside
threat-detection basic-threat
threat-detection statistics
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect rsh
inspect rtsp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
class class-default
user-statistics accounting
!
service-policy global_policy global
smtp-server 10.XX.XX.XX
prompt hostname context
no call-home reporting anonymous

[Marius Gunnerud]

could you run a packet-tracer on the ASA and post the result here (remove any public IPs)?

packet-tracer input outside tcp <external router IP> 12345 <ASA outside interface IP> 22

[itsupport08032020]

packet-tracer input Outside tcp EXTERNAL IP 22 OUTSIDE INTERFACE IP 22

Phase: 1
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
object network Internal_Router_Access
nat (inside,outside) static interface service tcp ssh ssh
Additional Information:
NAT divert to egress interface inside
Untranslate outside/22 to 10.XX.XX.5/22

Phase: 2
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group outside_access_in in interface outside
access-list outside_access_in extended permit tcp any object Internal_Router_Access eq ssh
Additional Information:

Phase: 3
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (inside,outside) after-auto source dynamic obj-10.XX.XX.0 interface
Additional Information:

Phase: 4
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 5
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 6
Type: VPN
Subtype: ipsec-tunnel-flow
Result: ALLOW
Config:
Additional Information:

Phase: 7
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
object network Internal_Router_Access
nat (inside,outside) static interface service tcp ssh ssh
Additional Information:

Phase: 8
Type: USER-STATISTICS
Subtype: user-statistics
Result: ALLOW
Config:
Additional Information:

Phase: 9
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 10
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 11
Type: USER-STATISTICS
Subtype: user-statistics
Result: ALLOW
Config:
Additional Information:

Phase: 12
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 1291545, packet dispatched to next module

Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: inside
output-status: up
output-line-status: up
Action: allow

[itsupport08032020 · Accepted solution]

I have figured it out after investigating routing on Cisco 2911. The issue is fixed after adding a static route to the cisco 2911 router. Cleary the port forwarding configuration on ASA5505 is good. Thanks for the assistance with this.

[Marius Gunnerud]

Glad you got it working.
Just FYI, i did imply in an earlier post to check your routing.