Regarding manual NAT in cisco ASA

[diwakar410]

I have cisco ASA 5515-x running version 9.2.  I want to port forward the request on 80 to 9006 which is of my DVR.

I did this :

Object network obj-10.10.26.6

host 10.10.26.6

Object network obj-203.156.213.173

host 203.156.213.173

object service port-80

          service tcp source eq 80

object service port-9006

          service tcp destination eq 9006

nat (inside,public-IP) source static obj-10.10.26.6 obj-203.156.213.173 service port-80 port-9006

I get this following error when I do port forwarding in the pool IP:

pac in public-IP tcp 8.8.8.8 12345 203.156.213.173 9006

Result:

input-interface: Public-IP

input-status: up

input-line-status: up

output-interface: Public-IP

output-status: up

output-line-status: up

Action: drop

Drop-reason: (nat-no-xlate-to-pat-pool) Connection to PAT address without pre-existing xlate

What am i doing wrong here? Why am i getting this error: "Drop-reason: (nat-no-xlate-to-pat-pool) Connection to PAT address without pre-existing xlate"

Please help. 

[Marius Gunnerud]

Your service object for port 9006 is wrong:

object service port-9006

          service tcp destination eq 9006

It should be source not destination:

object service port-9006

          service tcp source eq 9006

--

Please remember to select a correct answer and rate helpful posts

[diwakar410]

It is: request on 80 should be forwarded to 9006 so 9006 becomes the destination port, isn't it?Please clarify me. 

If so, does the command line remain the same?

nat (inside,public-IP) source static obj-10.10.26.6 obj-203.156.213.173 service port-80 port-9006????

[Marius Gunnerud]

No, you have look at it as the server being the source as it is located on the inside and you define the real interface as inside.

[diwakar410]

Hi Marius,

Thank you for your input. Couldn't get waht you mean. I am bit new to this ASA world so can you please help me out. 

If this becomes the source port :

object service port-9006

          service tcp source eq 9006

What will be the destination port then?

What will be the command line for NAT rules?

[Marius Gunnerud]

When you configure inside NAT, that is when you define the inside or private network first in the nat statement (nat (inside,outsdie)) then you need to look at the NAT statement from the server point of view.  It is listening and sending on port 9006, so from the server's point of view this is the source port.  So since the server is sending with a source port of 9006 your NAT statement should indicate the port as a source.  

Static NAT statments are bidirectional so when traffic comes from the outside to the inside network, it will be the reverse, and then be treated as destination port.

So your NAT statement should look like this.

nat (inside,public-IP) source static obj-10.10.26.6 obj-203.156.213.173 service port-9006 port-80 port-9006

nat (real_int,mapped_int) source static real_IP mapped_IP service real_port mapped_port

--

Please remember to select a correct answer and rate helpful posts

[diwakar410]

Thank you Marius,

Now, i am getting things. Just a query. Hope you don't mind this one. 

Previously, i had  Defence Center which was on 192.168.0.15  in my private network and my public IP was 201.135.201.73.

Inside my office i used to get access of DC  using https://192.168.0.15. I wanted this DC to be accessed from my home and remote office too.

So i did NAT this way:

object network obj-192.168.0.15

host 192.168.0.15

nat (private,public-ip) static interface service tcp https 7443

This way from remote office i used to go to browser and i used to do 201.135.201.73:7443 and i would get the access of Defence Center.

Hence, i thought this is the concept of manual NAT too. In this case, request on 443 is asked to be opened at 7443. 

443 is source port and 7443 is destination, port isn't it?

1.If so what changes in the manual nat?

2.Why do we use 9006 as source which if we had to do in auto nat would have easily been the destination port?

Actually, 201.135.201.73 is my Public IP and 203.156.213.173 is my pool IP that ISP has given and it is routable to my public ip.

3. Why can't i achieve this mapping of pool ip to the server in the inside using the auto nat?

Thank you in advance.

[Marius Gunnerud · Accepted solution]

1.If so what changes in the manual nat?

What changes is how you specify the ports.  In auto NAT you specify the ports directly after the tcp keyword. in manual NAT you specify the ports in a service object or object group.  

2.Why do we use 9006 as source which if we had to do in auto nat would have easily been the destination port?

Auto NAT doesn't use it as a destination port.  When the server replies to requests it will use a source port of 9006 not a destination port of 9006. If you use a destination port in the service object it will never match the NAT rule.

3. Why can't i achieve this mapping of pool ip to the server in the inside using the auto nat?

You can use auto NAT if you like.  No one is saying you can not use Auto NAT.

--

Please remember to select a correct answer and rate helpful posts

[hehe]

CSCun95075 - ASA drops packet due to nat-no-xlate-to-pat-pool after removing NAT rule Symptom: Once a twice NAT rule with a service translation is added, other traffic on the interface may also be dropped with a reason of nat-no-xlate-to-pat-pool. This is expected behavior and more details can be found here: http://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/firewall/asa_91_firewall_config/access_fwaaa.html#wp1331733 However, if the NAT rule references an object-group and that object-group is changed while the NAT rule is still configured, traffic may still be dropped even after removing the NAT rule. Conditions: All of the following conditions must be matched to see this issue: 1) The ASA is configured with a twice NAT rule that uses a service translation 2) The object-group referenced in the NAT rule is edited (i.e. a new network-object is added to it) while the NAT rule is still configured 3) The NAT rule is removed from the configuration Workaround: Reloading the ASA after the offending NAT rule is removed will resolve the issue. Bug Fixed in release : 9.1.5(1) or 9.1.2(100) Regards Karthik