Help with my first ASA config. (NAT/PAT)

[jeffrey77]

I am trying to set up NAT/PAT for access to a webserver behind the ASA.  (Running 8.4)

I have a single Static IP on the outside interface (70.102.23.xxx) and I have a webserver with an IP of 192.168.0.1 and I need to make sure all http requests are sent to it.

I can do this in a IOS router pretty well, but in the ASA I seem to get turned around pretty easily.  I would like to do it via CLi but will accept help with doing it via ASDM as well.

I already have created an access list to allow the traffic to the webserver.

access-list outside_access_in extended permit udp any any eq www

access-list outside_access_in extended permit tcp any any eq www

Thanks in advance.

Jeffrey

[Jouni Forss]

Hi,

We basically only see TCP SYN as indicated by the "S".

If this is all that is seen by the ASA then it means that the server is not replying or sending anything back to the ASA.

- Jouni

[jeffrey77]

So it is a issue with the server?

I also SSLVPN'd into the network and am not able to ssh into the box from there over 22 or 39124... I should be able to do so from the SSLVPON remote network of 100.100 correct?

[jeffrey77]

For testing purposes to see if it is responding on Port 22 How would I modify the NAT rul to send anything coming in on 39124 to be sent to the Server on port 22?

Would it be like this:

object network WEB-SERVER-TCP39214

nat (inside,outside) static interface service tcp 39124 22

?

[Jouni Forss]

Hi,

The ports are the different way around

object network WEB-SERVER-TCP39214

  nat (inside,outside) static interface service tcp 22 39124

Real ports first and then the mapped port.

Also remember that you will need an ACL rule allowing traffic to the real port of TCP/22 instead of the mapped port. Just like it is with the IP address where we use the real IP address.

- Jouni

[jeffrey77]

I think I see it. When I did the test i put in the Default Gateway and not the IP of the outside interface.

[jeffrey77]

Yes I do see it:

Gateway of last resort is 10.102.23.161 to network 0.0.0.0

Thanks again much!