cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
427
Views
0
Helpful
3
Replies

ASA5520 (8.4.5) static PAT trouble

SilkoYuri
Beginner
Beginner

Hello everybody.

I migrate from PIX515E(8.0.4) to ASA5520(8.4.5)

I have this configuration on PIX515E

static (ins10,INTERNET) tcp 10.1.15.5 5555 access-list POS_vpn_ns

access-list POS_vpn_ns extended permit tcp host 10.1.21.6 eq 5555 192.168.0.0 255.255.0.0

access-list POS_vpn_ns extended permit tcp host 10.1.21.6 eq 5555 172.16.0.0 255.255.0.0

I write this configuration to ASA below

ASA5520(config)# sh run object id obj-10.1.21.6-111

object network obj-10.1.21.6-111

host 10.1.21.6

ASA5520(config)# sh run object id obj-10.1.15.5-111

object network obj-10.1.15.5-111

host 10.1.15.5

ASA5520(config)# sh run object id obj-192.168.0.0

object network obj-192.168.0.0

subnet 192.168.0.0 255.255.0.0

ASA5520(config)# sh run object id portd5555

object service portd5555

service tcp destination eq 5555

ASA5520(config)# sh run object id ports5555

object service ports5555

service tcp source eq 5555

nat (ins10,INTERNET) source static obj-10.1.21.6-111 obj-10.1.15.5-111 destination static obj-192.168.0.0 obj-192.168.0.0 service portd5555 ports5555

packet-tracer input INTERNET 192.168.33.33 12456 10.1.15.5 5555

Phase: 1

Type: UN-NAT

Subtype: static

Result: ALLOW

Config:

nat (ins10,INTERNET) source static obj-10.1.21.6-111 obj-10.1.15.5-111 destination static obj-192.168.0.0 obj-192.168.0.0 service portd5555 ports5555

Additional Information:

NAT divert to egress interface ins10

Untranslate 10.1.15.5/5555 to 10.1.21.6/5555

Phase: 2

Type: ACCESS-LIST

Subtype: log

Result: ALLOW

Config:

access-group 100 in interface INTERNET

access-list 100 extended permit ip any any

Additional Information:

Phase: 3

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Phase: 4

Type: FOVER

Subtype: standby-update

Result: ALLOW

Config:

Additional Information:

Phase: 5

Type: NAT

Subtype:

Result: ALLOW

Config:

nat (ins10,INTERNET) source static obj-10.1.21.6-111 obj-10.1.15.5-111 destination static obj-192.168.0.0 obj-192.168.0.0 service portd5555 ports5555

Additional Information:

Static translate 192.168.33.33/12456 to 192.168.33.33/5555

Phase: 6

Type: ACCESS-LIST

Subtype: log

Result: ALLOW

Config:

access-group 100 out interface ins10

access-list 100 extended permit ip any any

Additional Information:

Phase: 7

Type: NAT

Subtype: rpf-check

Result: ALLOW

Config:

nat (ins10,INTERNET) source static obj-10.1.21.6-111 obj-10.1.15.5-111 destination static obj-192.168.0.0 obj-192.168.0.0 service portd5555 ports5555

Additional Information:

Phase: 8

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Phase: 9

Type: FLOW-CREATION

Subtype:

Result: ALLOW

Config:

Additional Information:

New flow created with id 40, packet dispatched to next module

Result:

input-interface: INTERNET

input-status: up

input-line-status: up

output-interface: ins10

output-status: up

output-line-status: up

Action: allow

On phase5 nat not working property (wrong translation)

On phase7 nat not working

Please tell me where i mistaked?

3 Replies 3

julomban
Participant
Participant

Yuri,

Please try the following:

object network obj-10.1.21.6

host 10.1.21.6

object network obj-10.1.15.5

host 10.1.15.5

object network obj-192.168.0.0

subnet 192.168.0.0 255.255.0.0

object network obj-172.16.0.0

subnet 172.16.0.0 255.255.0.0

object service obj-tcp-source-eq-5555

service tcp source eq 5555

!

nat (ins10,INTERNET) source static obj-10.1.21.6 obj-10.1.15.5 destination static obj-192.168.0.0 obj-192.168.0.0 service obj-tcp-source-eq-5555 obj-tcp-source-eq-5555

nat (ins10,INTERNET) source static obj-10.1.21.6 obj-10.1.15.5 destination static obj-172.16.0.0 obj-172.16.0.0 service obj-tcp-source-eq-5555 obj-tcp-source-eq-5555

Regards,

Juan Lombana

Please rate helpful posts.

thanks.

On real networks hosts it is work ok.

But ASA on phase1 write "Untranslate" (

What is meat "Untranslate" ?

Hi,

To my understanding "Untranslate" is a thing that happens when someone is connecting to a hosts NAT IP for example from the Internet

On the other hand if the host that has the NAT configuration initiates connection from LAN to Internet it would be seen as a

Phase x

Type: NAT

Looks a pretty "special" NAT configuration.

What is it configured for? Can you clarify the whole setup a bit?

Does it work after the last changes Juan suggested to it?

- Jouni

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers