Buy or Renew
Buy or Renew
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
2108
Views
10
Helpful
5
Replies

ASA (9.6) Static NAT with ACL

Go to solution
Alexander.Kuchumov
Level 1
Level 1

‎06-07-2020 03:35 AM

Dear all,

 

I had an issue with Static NAT, the task is - RADIUS client must be masqueraded from real IP 192.168.53.240 to assigned 192.168.46.1

i'we made my config as it in ASA Book:

Capture.JPG

 

My config:

 

object network RADIUS
host 192.168.46.250

object network RADIUS
nat (G_STAFF_INSIDE,G_STAFF_OUTSIDE) static 192.168.46.1


access-list OUTSIDE extended permit udp any host 192.168.46.250 range 1812 1813
access-group OUTSIDE in interface G_STAFF_OUTSIDE

G_STAFF_OUTSIDE - ingress interface(network 192.168.53.0/24),

G_STAFF_INSIDE - egress interface(network 192.168.46.0/24)

 

packet-tracert:

ASA(config)# packet-tracer input G_STAFF_OUTSIDE udp 192.168.53.240 11111 192.168.53.235 1812
Phase: 1
Type: CAPTURE
Subtype:
Result: ALLOW
Config:
Additional Information:
MAC Access list

Phase: 2
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list

Phase: 3
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
found next-hop 192.168.53.235 using egress ifc  identity

Phase: 4
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 5
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:

Result:
input-interface: G_STAFF_OUTSIDE
input-status: up
input-line-status: up
output-interface: NP Identity Ifc
output-status: up
output-line-status: up
Action: drop

I will be really appreciate for any help or advice.

Alex

Labels:
0 Helpful
1 Accepted Solution

Accepted Solutions

Go to solution
Alexander.Kuchumov
Level 1
Level 1
In response to Alexander.Kuchumov

‎06-10-2020 11:11 PM

So, i found a solution:

 

object network RADIUS
 subnet 192.168.53.0 255.255.255.0

!
nat (G_STAFF_OUTSIDE,G_STAFF_INSIDE) source dynamic RADIUS interface

!

access-list A_RUCKUS_INCOMMING extended permit udp any4 any4 range 1812 1813
access-group A_RUCKUS_INCOMMING in interface G_STAFF_OUTSIDE

!

 

as a destination for request you should put real IP address of server and as aGW will be OUTSIDE interface of ASA.

 

BTW, Many thanks to Sheraz.Salim for his kind help and efforts!

 

Sia,

Alex

View solution in original post

0 Helpful
5 Replies 5

Go to solution
Sheraz.Salim
VIP
VIP

‎06-07-2020 05:01 AM - edited ‎06-07-2020 05:06 AM

try this and past the result


object network RADIUS
host 192.168.46.250
!
object network RADIUS
nat (G_STAFF_INSIDE,G_STAFF_OUTSIDE) static 192.168.53.X
!
access-list OUTSIDE extended permit udp any host 192.168.46.250 range 1812 1813
access-group OUTSIDE in interface G_STAFF_OUTSIDE
!
packet-tracer input G_STAFF_OUTSIDE udp 8.8.8.8 11111 192.168.53.X 1812

 

 

please do not forget to rate.

Go to solution
Alexander.Kuchumov
Level 1
Level 1
In response to Sheraz.Salim

‎06-07-2020 10:27 PM

Dear Sheraz Salim,

 

Thanks for your quick reply, i tried your example with error:

ASA(config)# object network RADIUS
ASA(config-network-object)# host 192.168.46.250
H9764-GST-ASA(config-network-object)# nat (G_STAFF_INSIDE,G_STAFF_OUTSIDE) static 192.168.53.235
ERROR: Address 192.168.53.235 overlaps with G_STAFF_OUTSIDE interface address.
ERROR: NAT Policy is not downloaded

192.168.53.235 - IP of ingress interface

even if i apply 192.168.53.240 (device that initiate connection i get same output from packet tracer:

ASA(config)# packet-tracer input G_STAFF_OUTSIDE udp 192.168.53.240 11111 192.168.53.235 1812

Phase: 1
Type: CAPTURE
Subtype:
Result: ALLOW
Config:
Additional Information:
MAC Access list

Phase: 2
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list

Phase: 3
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
found next-hop 192.168.53.235 using egress ifc  identity

Phase: 4
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 5
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:

Result:
input-interface: G_STAFF_OUTSIDE
input-status: up
input-line-status: up
output-interface: NP Identity Ifc
output-status: up
output-line-status: up
Action: drop

 

Will be appreciate for your kind help,

Alex 

0 Helpful

Go to solution
Sheraz.Salim
VIP
VIP
In response to Alexander.Kuchumov

‎06-08-2020 03:49 AM

you outside ASA interface ip address is 192.168.53.235

and your private Radius server is 192.168.46.250

and you also barrow a spare ip address from your outside interface let say 192.168.53.10

 

ASA(config)# object network RADIUS
ASA(config-network-object)# host 192.168.46.250
H9764-GST-ASA(config-network-object)# nat (G_STAFF_INSIDE,G_STAFF_OUTSIDE) static 192.168.53.10

access-list OUTSIDE_IN extended permit udp any host 192.168.46.250 eq 1812

access-group OUTSIDE_IN in interface outside

!

packet-tracer input G_STAFF_OUTSIDE udp 8.8.8.8 11111 192.168.53.235 1812

or

packet-tracer input G_STAFF_OUTSIDE udp 192.168.53.7 1812 192.168.53.235 1812 detail

please do not forget to rate.

Go to solution
Alexander.Kuchumov
Level 1
Level 1
In response to Sheraz.Salim

‎06-08-2020 04:10 AM

Dear Sheraz Salim,

 

Nope, i tried:

ASA(config)# object network RADIUS
ASA(config-network-object)# host 192.168.46.250
ASA(config-network-object)# nat (G_STAFF_INSIDE,G_STAFF_OUTSIDE) static 192.168.53.236

access-list OUTSIDE_IN extended permit udp any host 192.168.46.250 eq 1812

access-group OUTSIDE_IN in interface outside

and get same issue:

ASA# packet-tracer input G_STAFF_OUTSIDE udp 8.8.8.8 11111 192.168.53.235 1812

Phase: 1
Type: CAPTURE
Subtype:
Result: ALLOW
Config:
Additional Information:
MAC Access list

Phase: 2
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list

Phase: 3
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
found next-hop 192.168.53.235 using egress ifc  identity

Phase: 4
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 5
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:

Result:
input-interface: G_STAFF_OUTSIDE
input-status: up
input-line-status: up
output-interface: NP Identity Ifc
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

-----------------------------------------------------------
ASA# packet-tracer input G_STAFF_OUTSIDE udp 192.168.53.240 1812 192.168.53.235 1812 detail

Phase: 1
Type: CAPTURE
Subtype:
Result: ALLOW
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0x7ff04c9202a0, priority=13, domain=capture, deny=false
        hits=386779, user_data=0x7ff04c403170, cs_id=0x0, l3_type=0x0
        src mac=0000.0000.0000, mask=0000.0000.0000
        dst mac=0000.0000.0000, mask=0000.0000.0000
        input_ifc=G_STAFF_OUTSIDE, output_ifc=any

Phase: 2
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0x7ff04c92d260, priority=1, domain=permit, deny=false
        hits=26710, user_data=0x0, cs_id=0x0, l3_type=0x8
        src mac=0000.0000.0000, mask=0000.0000.0000
        dst mac=0000.0000.0000, mask=0100.0000.0000
        input_ifc=G_STAFF_OUTSIDE, output_ifc=any

Phase: 3
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
found next-hop 192.168.53.235 using egress ifc  identity

Phase: 4
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0x7ff04b8a6690, priority=0, domain=nat-per-session, deny=true
        hits=87414063, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
        input_ifc=any, output_ifc=any

Phase: 5
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0x7ff04c8c9530, priority=0, domain=permit, deny=true
        hits=52803, user_data=0xa, cs_id=0x0, use_real_addr, flags=0x1000, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
        input_ifc=G_STAFF_OUTSIDE, output_ifc=any

Result:
input-interface: G_STAFF_OUTSIDE
input-status: up
input-line-status: up
output-interface: NP Identity Ifc
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

Let me start from the beginning:

WIFI controller from network 192.168.53.0/24 with IP 192.168.53.240 should reach RADIUS in 192.168.46.0/24 with IP 192.168.46.250. But request to RADIUS must been from source IP 192.168.46.1 only.

ASA interface in .53.0 - 192.168.53.235

ASA interface in .46.0 - 192.168.46.1

 

BTW in your example i get error in Access-list phase.

 

Thank you,

Alex

0 Helpful

Go to solution
Alexander.Kuchumov
Level 1
Level 1
In response to Alexander.Kuchumov

‎06-10-2020 11:11 PM

So, i found a solution:

 

object network RADIUS
 subnet 192.168.53.0 255.255.255.0

!
nat (G_STAFF_OUTSIDE,G_STAFF_INSIDE) source dynamic RADIUS interface

!

access-list A_RUCKUS_INCOMMING extended permit udp any4 any4 range 1812 1813
access-group A_RUCKUS_INCOMMING in interface G_STAFF_OUTSIDE

!

 

as a destination for request you should put real IP address of server and as aGW will be OUTSIDE interface of ASA.

 

BTW, Many thanks to Sheraz.Salim for his kind help and efforts!

 

Sia,

Alex

0 Helpful
Customers Also Viewed These Support Documents