Configuring inbound NAT for an IP protocol

[ROBERTO GIANA]

Hi

How do we configure an inbound NAT for IP protocol 41 from the outside interface to a DMZ host within ASA v9.1? A 1:1 translation is due to the sparse IPs not an option.

ASA v9.1 refuses to configure a service translation when it's not a TCP nor UDP.

Greetings

Roberto

[Julio Carvajal]

Hello Roberto,

Looks like you are performing a service or port redirection ( that will not work as the only protocols that have services are TCP/UDP )

You will need to do a mapping one to one, IP-to-IP to make this happen, not using services

Regards

[ROBERTO GIANA]

Hi Julio

C'mon! Every $50 SOHO gear can do that. My $4000 ASA doesn't?

Regards

[Julio Carvajal]

Hello Roberto,

I think we are talking about different things,

I mean how are you going to do a port-forwarding about a protocol that does not have any ports........

Do you follow me?? Is not an ASA restriction it's just that PAT requires Ports.

[ROBERTO GIANA]

Hi Julio

I'm completly with you. I don't want to do a "port" translation. All I want ist all incomming IP protocol X traffic to be NATed and forwarded to internal IP X. IP protocol Y traffic to be NATed and forwarded to internal IP Y. All on one public IP on the outside interface. Basicly the same as the PPtP inspection already does for the GRE tunnel data (IP proto 47) or the IPSec inspection for the ESP data (IP proto 50). But instead of doing it dynamicly based on the PPtP or IKE data I want to configure it manually for any given IP protocol number.

Regards

[Julio Carvajal]

Hello Roberto,

Yeah man, sorry to inform you that it's just not possible...

You cannot do that, all you can do is a one to one mapping or at least the tcp/udp port-forwarding. As your protocol does not have any port, option one is the only option.

The only thing that I have seen like this is the PPTP inspection starting on 8.3 and you will need to enable the inspection for the protocol so you can dynamically allocate the GRE traffic.This without the need for an IP protocol but for what you are looking for there is config,

Sorry!

Regards,