Problem with cisco 5510 port mapping

[raidokuvarnet]

Hello,

My device Cisco ASA 5510, ASA 8.4(2), ASDM 6.4(5)206

What I try to achieve.

1) Host 10.10.11.108 listening port 8080

2) Trying to access it from WAN e.g port 8090

I tried following commands:

object network 10.10.11.108_8080
host 10.10.11.108
nat (LAN1,WAN) static interface service tcp 8080 8090

access-list WAN_access_in line 11 extended permit tcp any object 10.10.11.108_8080 eq 8080
access-group WAN_access_in in interface WAN

But I don't gett access. Can someone help me to solve this case?

[raidokuvarnet]

Result of the command: "packet-tracer input wan tcp 4.2.2.2 8888 80.250.119.69 8090 det"

Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0xda1d5568, priority=1, domain=permit, deny=false
hits=5697523304, user_data=0x0, cs_id=0x0, l3_type=0x8
src mac=0000.0000.0000, mask=0000.0000.0000
dst mac=0000.0000.0000, mask=0100.0000.0000
input_ifc=WAN, output_ifc=any

Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 80.250.119.69 255.255.255.255 identity

Phase: 3
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0xd9364000, priority=0, domain=permit, deny=true
hits=463202, user_data=0x9, cs_id=0x0, use_real_addr, flags=0x1000, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
input_ifc=WAN, output_ifc=any

Result:
input-interface: WAN
input-status: up
input-line-status: up
output-interface: NP Identity Ifc
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

[Marius Gunnerud]

hmm, doesn't seem to be hitting the NAT rule.

Could you post the output of "show nat 10.10.11.108"

--

Please remember to select a correct answer and rate helpful posts

[raidokuvarnet]

Result of the command: "show nat 10.10.11.108"

Manual NAT Policies (Section 1)
1 (LAN1) to (WAN) source static 10.10.11.108_8080 interface service tcp-8080 tcp-8090
translate_hits = 0, untranslate_hits = 0
3 (LAN1) to (WAN) source static obj_10.10.11.108 interface service 37777 37777 description KK 12.08.2013 Securer videovalve
translate_hits = 0, untranslate_hits = 33

[Marius Gunnerud · Accepted solution]

I think I know what the problem is:

object service tcp-8080
 service tcp destination eq 8080 
object service tcp-8090
 service tcp destination eq 8090 

change it to source instead of destination:

object service tcp-8080
 service tcp source eq 8080 
object service tcp-8090
 service tcp source eq 8090 

no access-list WAN_access_in extended permit object tcp-8080 any object 10.10.11.108_8080 

access-list WAN_access_in extended permit tcp any object 10.10.11.108_8080 eq 8080

--

Please remember to select a correct answer and rate helpful posts