Hi together,
i have some problems with the NAT statements in ASA Version 8.4.
What i want is to translate the internal address of a server to the external address with a NAT rule.
The ASA has only one WAN connection (named outside)
The internal server has the ip address 192.168.0.221 (as example) and i want to translate all incoming traffic on port 3389 to the Server (192.168.0.221).
This is only for training, i dont want to forward a 3389 port into the BAD in a productive Network
first i create the network object for the inside server (192.168.0.221)
object network Network_Obj_RDP
host 192.168.0.221
After that i create the access rule for incoming traffic on outside interface:
access-list outside_access_in extended permit ip any any log debugging
Next i create a access rule for the inside-prod network to allow the traffic to the RDP Server:
access-list inside-prod_access_in extended permit object RDP interface outside object Network_Obj_RDP
Now i create the NAT rule in the network object (Network_Obj_RDP):
object network Network_Obj_RDP
nat (inside-prod,outside) static interface service tcp 3389 3389
But if i want to connect via 3389 on the outside interface i see in the syslog this entry:
|
|
|
|
|
|
|
| Built inbound TCP connection 23248 for outside:80.187.107.132/7445 (80.187.107.132/7445) to inside-prod:192.168.0.221/3389 (External IP/3389) |
After a while the connection will be teardown with this message:
|
|
|
|
|
|
|
| Teardown TCP connection 23289 for outside:80.187.107.132/2294 to inside-prod:192.168.0.221/3389 duration 0:00:30 bytes 0 SYN Timeout |
It looks like that the acl works fine, but the NAT translation are wrong...
perhaps somebody has a idea to fix this
Looking forward and hope for help...
Many thanks
Greetings
