Hi all
I can't quit hit the nail on the head with this one. Any help would be very much appreciated please :)
Cisco ASA 5505
Running 8.4(1)
Example of what I am trying to do (I've basically ran out of public IPs and need to direct access to certain hosts and services inside but for complicated reasons I won't go in to as it won't help here/just complicate it more for no reason, they can't be on the 'general usage' IP so I need to share some of these other public IPs).
Public IP range: 12.34.56.1 - 12.34.56.5
Internal IP range: 192.168.1.1 - 192.168.1.254
12.34.56.5:
'General usage' IP. So by default everything goes in and out on this IP.
12.34.56.1:
Port 443 goes to 192.168.1.2
Port 80 goes to 192.168.1.3
Traffic from 192.168.1.2 and 192.168.1.3 to the internet comes from 12.34.56.1
12.34.56.2/.3/.4:
These are all dedicated to certain servers and work fine.
Bits of the config I think are relevant (please say if I've missed something):
interface Vlan2
nameif outside
security-level 0
ip address 12.34.56.5 255.255.255.248
object network LAN
subnet 192.168.1.0 255.255.255.0
object network NAT-IP-1
host 12.34.56.1
object network server-2
host 192.168.1.2
object network server-3
host 192.168.1.3
object-group network SOURCE-ADDRESSES-2
network-object host 192.168.1.2
network-object host 192.168.1.3
access-list outside_access extended permit tcp any object server-2 eq https
access-list outside_access extended permit tcp any object server-3 eq www
nat (inside,outside) source dynamic SOURCE-ADDRESSES-2 NAT-IP-1
object network LAN
nat (inside,outside) dynamic interface
object network server-2
nat (inside,outside) static NAT-IP-1 service tcp https https
Traffic for server-2 and server-3 goes out on 12.34.56.1 instead of 12.34.56.5, that's fine. The port forwarding isn't happening though.
This results in this in the log:
4 Mar 19 2015 15:00:45 106023 5.6.7.8 53966 12.34.56.1 443 Deny tcp src outside:5.6.7.8/53966 dst outside:5.6.7.8/443 by access-group "outside_access" [0x0, 0x0]
If I do a packet trace it's just not showing the NAT entries expected (and the log above doesn't show the destination as the LAN IP either as expected):
Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list
Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 12.34.56.1 255.255.255.248 outside
Phase: 3
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule
What am I messing up with the NATing/port forwarding please?
Thank you!
Edit: Sorry John. Typo - corrected!
