New at Firewall NAT/ACL commands on ASA FP 1100 Series

[gnoetzel1125]

Hey there...I hope there are wealth of experts here.  I have a need of your opinion with the below configuration that I created with help of several references and google search results.

Here's the project:

We have an appliance that is ON_PREM (35.35.35.35).  This appliance will be connected between the Firewall and CoreSwitch.  The CLOUD_WEB (120.120.120.120) will be used to service & manage the ON_PREM device.  We have a spare public facing IP address (12.12.12.12).   The ON_PREM & CLOUD_WEB will utilize AD LDAP protocols to authenticate users who are authenticated to browse the web.

Purpose of the ON_PREM appliance is to filter web contents.  Will the below OBJECT/ACL/NAT rules work?

Create Object:

object network CLOUD_WEB
host 120.120.120.120

object network ON_PREM
host 35.35.35.35

Create Port Forwarding:

nat (inside,outside) source static ON_PREM interface service tcp ldap ldap

Create ACL:

access-list OUTSIDE_IN permit tcp object CLOUD_WEB host 12.12.12.12 eq ldap
access-group OUTSIDE_IN in interface outside

Legend:

CLOUD_WEB = Cloud Management Services Static IP Address

ON_PREM = On Prem Device - gets management & services from CLOUD_WEB

12.12.12.12 = Public Face IP Address

I appreciate your opinions.

[Rob Ingram · Accepted solution]

@gnoetzel1125 You've used "interface" in your NAT rule, is 12.12.12.12 the actual physical IP address of the outside interface? If not that rule won't work.

Also, you need to use the real (untranslated) IP address in the firewall rule, not the NAT IP address.

[gnoetzel1125]

Rob - thank you for the clarification.  It is a 'routed' IP address that we have a bank of public IP address that can be used for separating type of internet traffic.  I removed the interface from the configuration.  Below are the changes:

Create OBJECT:

object network CLOUD_WEB
host 120.120.120.120

object network ON_PREM
host 10.10.10.10

Create NAT:

nat (inside,outside) source static ON_PREM 12.12.12.12 service tcp ldap ldap

Create ACL:

access-list OUTSIDE_IN permit tcp object CLOUD_WEB host 12.12.12.12 eq ldap
access-group OUTSIDE_IN in interface outside

[Rob Ingram]

@gnoetzel1125 use an object for the public IP on the NAT rule. Or alternatively you could also use an object for the static PAT, example:-

object network SVR
 host 10.10.10.10
 nat (inside,outside) static 12.12.12.12 service tcp ldap ldap

You need to use the real IP - 10.10.10.10 in the ACE, not the NAT IP.

access-list OUTSIDE_IN permit tcp object CLOUD_WEB host 10.10.10.10 eq ldap

If there is still a problem after you have made the changes, run packet-tracer to simulate the traffic flow and provide the output for review.

[gnoetzel1125]

Rob - thank you for your recommendation on the PAT, however, I am going to use the traditional rules so that the next person after me will be able to figure out the rules.