NAT on 5512X - just not getting it...

[abatson]

Greetings;

My config is below. This is a new setup, with an Internet connection connected to gi0/0. Note that the IP subnet I forged on gi0/0 is fake, but I did that to ensure you can tell it apart from the protected networks on the inside. I've been thru a bunch of NAT documents, but I still can't get it...

Requirements:

1.) I need every interface pingable (even Outside) for initial troubleshooting, then I can turn it off.

2.) I have a static IP on gi0/0. I need every protected subnet to hide-NAT behind the static IP on gi0/0. The protected subnets (ifNames) are management77, Black, Purple, Red and Blue.

3.) Given that ACL's and icmp commands I have in place, I can't traceroute through the firewall (SRC=management77 DST=199.27.79.73, which is cnn.com) every hop drops my packets.

Help me stop screaming!

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2015.04.28 15:33:26 =~=~=~=~=~=~=~=~=~=~=~=

firewall#

firewall# show run
: Saved
:
ASA Version 9.1(2)
!
hostname firewall
enable password xxxxxxxxxxxxxxxx encrypted
names
!
interface GigabitEthernet0/0
 description Ethernet from External Switch
 speed 1000
 duplex full
 nameif Outside
 security-level 100
 ip address 138.138.138.138 255.255.255.252
!
interface GigabitEthernet0/1
 speed 1000
 duplex full
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/1.10
 description Red
 vlan 10
 nameif Red
 security-level 100
 ip address 192.168.10.1 255.255.255.0
!
interface GigabitEthernet0/1.20
 description Blue
 vlan 20
 nameif Blue
 security-level 100
 ip address 192.168.20.1 255.255.255.0
!
interface GigabitEthernet0/2
 description VLAN 99_Orange
 speed 1000
 duplex full
 nameif Orange
 security-level 100
 ip address 192.168.99.1 255.255.255.0
!
interface GigabitEthernet0/3
 description VLAN 30_Black
 speed 1000
 duplex full

 nameif Black
 security-level 100
 ip address 192.168.30.1 255.255.255.0
!
interface GigabitEthernet0/4
 description VLAN 40_purple
 speed 1000
 duplex full
 nameif purple
 security-level 100
 ip address 192.168.40.1 255.255.255.0
!
interface GigabitEthernet0/5
 speed 1000
 duplex full
 nameif management77
 security-level 100
 ip address 192.168.77.1 255.255.255.0
!
interface Management0/0
 management-only
 no nameif
 security-level 100
 no ip address
 
!
boot system disk0:/asa912-smp-k8.bin
ftp mode passive
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network obj-management77
 subnet 192.168.77.0 255.255.255.0
!
access-list outside-access-in extended permit icmp any any
access-list outside-access-in extended deny ip any any
access-list mgmt-access-in extended permit icmp any any
access-list mgmt-access-in extended permit ip any any
pager lines 24
logging asdm informational
mtu Outside 1500
mtu Orange 1500
mtu Black 1500
mtu purple 1500
mtu management77 1500
mtu Red 1500
mtu Blue 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any Outside
icmp permit any Black
icmp permit any purple

icmp permit any management77
icmp permit any Red
icmp permit any Blue
asdm image disk0:/asdm-713.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
!
object network obj-management77
 nat (management77,Outside) static interface
!
access-group outside-access-in in interface Outside
access-group mgmt-access-in in interface management77
route Outside 0.0.0.0 0.0.0.0 138.138.138.138.137 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL

no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh 192.168.77.0 255.255.255.0 management77
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ssl encryption rc4-sha1 aes128-sha1 aes256-sha1 3des-sha1
username cisco password xxxxxxxxxxxxxxxx encrypted privilege 15
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512

policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny  
  inspect sunrpc
  inspect xdmcp
  inspect sip  
  inspect netbios
  inspect tftp
  inspect ip-options
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:xxxxxxxxxxxxxxxxxxxxxxx
: end

firewall#    

firewall#

firewall#

[Akshay Rastogi · Accepted solution]

1. ) Bydefault all interfaces of ASA are pingable from their own security zone. so no need to specifically permit anything on these interface.
In case you have applied any access-list on Outside Interface then configure 'icmp permit any outside' (for your icmp testing). 'no' form of this command to disable the same. I could see that you have already enabled this command.

2.) For second requirement, you could perform Interface PAT on the Outside Interface for all your protected subnets.
statement could be like.

Step: create Objet network :

#object network obj-management77
  #subnet <network> <mask>
  #nat (management77,Outside) dynamic interface

#object network obj-Black
  #subent <network><mask>
  #nat(Black,Outside) dynamic interface

and so on for other protected networks.

Please use the link below to understand the same :

http://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/firewall/asa_91_firewall_config/nat_objects.html#pgfId-1455942

Note : Dynamic NAT is unidirectional in natrue. Connection could be only initiated from  Protected Network to Outside Network.  Any connection to Natted IP from Outside host wll be dropped.

3.) To permit tracerroute through ASA, please use the below link:

you could add :

Configure these inspections:

inspect icmp error
inspect icmp

Also change the change the 'icmp unreachable' command :

#no icmp unreachable rate-limit 1 burst-size 1

#icmp unreachable rate-limit 10 burst-size 5

configure Access-list :

#access-list outside-access-in extended permit icmp any any unreachable
#access-list outside-access-in extended permit icmp any any time-exceeded

http://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/15246-31.html#trace

I hope this answers your query. If you have any other query , please let me know.

Thanks and Regards,
Akshay Rastogi