NAT translation perform before check inside ACL when Reflexive ACL active

[aldrabkin]

Hi all !

I'm looking for help with a strange problem with NAT and RACL. I have a router Cisco 2951 15.5(3)M IOS with LAN and WAN interfaces.

There is one inbound ACL "INTERNET" on LAN inteface with rules that permit and deny some traffic from local net to Internet. For example, network 192.168.10.0 is allowed to connect to some external ip address on port 670.

WAN interface has two ACLs: outbound ACL "FROM_LAN" - permit ip any any reflect to_INET timeout 300

                                                 inbound ACL "acl_WAN_in"- permit ssh to router, permit icmp, permit ntp, evaluate to_INET and deny ip any any log

So network 192.168.10.0 can not connect to external ip on port 670. In show logging i can see something like that: access-list INTERNET deny ROUTER_WAN_IP to external_ip port 670. It seems that the nat translation is perfomed before inbound ACL checking, but this contradicts cisco order of opertaions. I can solve my problem in several ways:

1) Delete ACL "INTERNET"

2) Add rule fo ACL "INTERNET": permit ip host ROUTER_WAN_IP host external_ip 

3) Delete Reflexive ACL "to_INET"

But i don't want do this, i think my initial configuration should work but it doesnt. I'm really confused. Can anyone help me ? Thanks in advance !

[Masoud Pourshabanian]

Hello,

You need to allow public ip used in NAT on inbound ACL  on WAN for return traffic. First Inbound ACL on WAN then translation of public ip to internal ip

Masoud

[aldrabkin]

Hi, all ! Thx for your answers. I've tried domain-less nat and i allowed public ip used in NAT on inbound ACL, but nothing worked.

I think it is not NAT problem, it is about Reflexive ACL. When RACL is on WAN router interface then ACL "INTERNET" (on internal router interface) block traffic going from inside to outside and at the same time source ip address is router's WAN interface address.

[Masoud Pourshabanian]

Adding to my previous comment

ACL is stateless so you need to consider return traffic as well.

1- Traffic from inside to outside.

  A: First inbound ACL on LAN interface, then NAT so you need to permit 192.168.10.0 as  source  in your ACL

  B: Source NAT, then outbound ACL on WAN. You need to permit public IP used in NAT as source in your ACL ( it is any any in your case)

2- Traffic from outside to inside

 A: First inbound ACL on WAN, you need to permit public IP used in NAT as destination in your ACL

 B: Destination NAT, then outbound ACL on LAN interface. You need to permit 192.168.10.0 as destination in your ACL ( You do not have this ACL, so forget it)

Hope it helps,

Masoud

[paul driver]

Hello

Have you tried using domain-less nat to accomplish this..

https://supportforums.cisco.com/discussion/12236031/how-can-i-get-work-nat

res

paul

[aldrabkin]

The problem solved by downgrade to 15.4.3 IOS.

Thanks for help!