UNABLE TO TELNET FROM OUTSIDE INTERFACE

[isaaco001]

Hi community,

I have tried this port forwarding  for some time now but i cant see why its not working, i have looked at some forums but still i keep getting errors like asymmetric nat. please assist.

am trying to telnet from an outside ip to inside router behind ASA.please find run config attached.

object network R3
nat (Inside-dmz,outside) static interface service tcp telnet telnet

access-group outside_access_in in interface outside

Thank you all!

[Marvin Rhoads]

From a quick glance it looks ok. What does packet-tracer tell you? e.g.:

packet-tracer input outside tcp 8.8.8.8 1025 192.168.3.1 23

[isaaco001]

Hi Marvin,

Firstly, thanks for the reply.

I have continued working on it and made changes to the configuration to make things simpler. I just have two interface now inside and outside,but its essentially the same.

log from monitoring

5

Mar 03 2019

14:35:47

305013

192.168.137.10

32592

192.168.1.1

23

Asymmetric NAT rules matched for forward and reverse flows; Connection for tcp src outside:192.168.137.10/32592 dst inside:192.168.1.1/23 denied due to NAT reverse path failure

Packet tracer indicates that there's a nat problem. in this lab, 192.168.137.10 represents "internet".

[isaaco001]

This is the  packet tracer snapshot ,attached.

[Marvin Rhoads]

Please share the nat and routing configuration stanzas. i.e., "show run nat" and "show run route".

[venkat_n7 · Accepted solution]

if you have to telnet from outside to inside, we do use nat'd IP of firewall to connect to inside host. from basics, try to telnet from your router 192.168.137.10 - to - firewall outside interface 192.168.137.1. Because you did PAT over firewall, so if you want to telnet router with ip 192.168.1.1 from 192.158.137.10 use NAT's IP which is 192.168.137.1 to get telnet access to 192.168.1.1 router.

[isaaco001]

hi venkat_n7,

Thanks,this explains it!

Regards,

Isaac.