08-01-2019 01:39 PM
I've been banging my head against a wall for 2 days trying to get this to work, and I just can't seem to figure it out. I have an ASA-5506 on a very small working network, and i'm trying to add the necessary rules to allow public access to an internal server through the single external IP, on port 22. I've followed a number of guides online including the one at the link below, and no matter what I do, I keep getting TCP access denied by ACL from Source_IP to MyPublic_IP. I tried to included the relevant lines from my config below. Anyone have any suggestions?
object network Server_Name
host 10.240.240.83
Auto NAT Policies (Section 2)
1 (inside) to (outside) source static Server_Name interface service tcp ssh ssh
access-list outside_access_in extended permit tcp any object Server_Name eq ssh
https://www.petenetlive.com/KB/Article/0000077
Solved! Go to Solution.
08-01-2019 02:08 PM
Remove that NAT rule and re-add but make sure you use the command "after-auto". E.g.
nat (INSIDE,OUTSIDE) after-auto source dynamic any interface
This will move that NAT rule to Section 3 and allow traffic to hit your static NAT rule
HTH
08-01-2019 01:51 PM
08-01-2019 02:02 PM
I'm not showing any hits on my NAT rule. The one that was created for this is a "Network Object" NAT rule which was auto generated by the firewall when I added the NAT settings under the host. I do have another NAT rule for outgoing traffic that includes the range that this server IP is in, and it is in a higher section.
The packet-tracer ends with the following:
Result
input-interface: outside
input-status: up
output-line-status: up
output-interface: NP Identity Ifc
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule
08-01-2019 02:08 PM
Remove that NAT rule and re-add but make sure you use the command "after-auto". E.g.
nat (INSIDE,OUTSIDE) after-auto source dynamic any interface
This will move that NAT rule to Section 3 and allow traffic to hit your static NAT rule
HTH
08-02-2019 11:25 AM
That did it. Thanks for the help!
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide