Same behavior:
| 7 | Dec 01 2019 | 02:10:49 | 710005 | 178.127.181.1 | 56141 | 134.17.5.142 | 8443 | TCP request discarded from 178.127.181.1/56141 to mts-out:134.17.5.142/8443 |
AnyConnect Portal works fine: https://134.17.5.142/+CSCOE+/logon.html
The following is a complete ASA configuration. Thus, the inside is connected directly to the Catalyst router, where there is a vlan with this IP address. The outside interface receives the address and the static route automatically.
+ NO any static routes
Gateway of last resort is 134.17.4.1 to network 0.0.0.0 C 172.16.8.0 255.255.255.0 is directly connected, Wifi C 172.16.0.0 255.255.255.0 is directly connected, inside S 172.16.100.10 255.255.255.255 [1/0] via 134.17.4.1, mts-out C 134.17.4.0 255.255.252.0 is directly connected, mts-out d* 0.0.0.0 0.0.0.0 [1/0] via 134.17.4.1, mts-out
Judging by the packet tracer, any request that comes from the outside interface does not fall into the NAT rules.
Result of the command: "sh run" : Saved : ASA Version 9.1(3) ! hostname domain-name enable names ip local pool Office_VPN 172.16.100.10-172.16.100.200 mask 255.255.255.0 ! interface Ethernet0/0 nameif inside security-level 100 ip address 172.16.0.1 255.255.255.0 ! interface Ethernet0/1 speed 1000 nameif mts-out security-level 0 ip address dhcp setroute ipv6 enable ! interface Ethernet0/2 nameif Wifi security-level 0 ip address 172.16.8.1 255.255.255.0 ! interface Ethernet0/3 shutdown nameif CORP security-level 0 ip address 10.0.0.1 255.255.255.0 ! interface Management0/0 shutdown nameif management security-level 100 ip address dhcp setroute ! ftp mode passive clock timezone EEST 2 clock summer-time EEDT recurring last Sun Mar 2:00 last Sun Oct 3:00 dns domain-lookup inside dns domain-lookup mts-out dns server-group DefaultDNS name-server 172.16.0.254 domain-name same-security-traffic permit inter-interface same-security-traffic permit intra-interface object network Local_Office_Network subnet 172.16.0.0 255.255.255.0 description Local Network object network VPN_Minsk subnet 172.16.100.0 255.255.255.0 description VPN_Minsk object network VPN subnet 172.16.100.0 255.255.255.0 object network VPN1 subnet 172.16.100.0 255.255.255.0 object network SVN-EXT host 172.16.0.250 object network obj_172.16.0.250 host 172.16.0.250 object network SVN-NAT host 172.16.0.250 object network SVN_NAT host 172.16.0.250 object network RocketChat host 172.16.0.100 object-group protocol TCPUDP protocol-object udp protocol-object tcp object-group service DM_INLINE_SERVICE_2 service-object icmp echo service-object icmp echo-reply service-object icmp6 echo service-object icmp6 echo-reply service-object icmp6 unreachable access-list inside_access_in extended permit ip object Local_Office_Network any access-list inside_access_in extended permit ip object VPN_Minsk any access-list inside_access_in extended permit icmp any any access-list inside_access_in extended permit ip any interface CORP access-list Beltelecom_access_in extended permit ip any any access-list Beltelecom_access_in extended permit tcp any any eq www access-list Beltelecom_access_in extended permit object-group DM_INLINE_SERVICE_2 any any access-list Beltelecom_access_in extended permit tcp any interface mts-out eq 8443 access-list Beltelecom_access_in extended permit tcp any interface mts-out eq 8081 access-list Beltelecom_access_in extended permit tcp any any eq 9000 access-list Office_Allowed remark Jira/Bamboo/BitBucket access-list Office_Allowed standard permit 172.16.0.0 255.255.255.0 access-list Wifi_access_in extended permit ip any any access-list nonat_rule extended permit ip 172.16.100.0 255.255.255.0 172.16.0.0 255.255.255.0 access-list nonat_rule extended permit ip any object VPN_Minsk access-list mts-out_access_in extended permit ip any any access-list mts-out_access_in extended permit ip any interface mts-out access-list mts-out_access_in extended permit object-group TCPUDP any object SVN-EXT eq www access-list Sound extended permit ip any object SVN-EXT access-list outside-access-inside extended permit tcp any host 172.16.0.250 eq 8080 access-list sound standard permit host 172.16.0.250 access-list global_mpc extended permit ip any any pager lines 24 logging enable logging list auth level debugging logging asdm auth logging debug-trace logging class auth asdm informational logging class vpn asdm informational logging class ssl asdm informational flow-export destination inside 172.16.0.115 2055 mtu inside 1500 mtu mts-out 1480 mtu Wifi 1500 mtu CORP 1500 mtu management 1500 no failover icmp unreachable rate-limit 1 burst-size 1 asdm image disk0:/asdm-714.bin no asdm history enable arp timeout 14400 no arp permit-nonconnected nat (Wifi,mts-out) source dynamic any interface nat (CORP,inside) source static any any dns no-proxy-arp route-lookup ! object network RocketChat nat (inside,mts-out) static interface service tcp https 8443 ! nat (inside,mts-out) after-auto source dynamic any interface access-group inside_access_in in interface inside access-group Beltelecom_access_in in interface mts-out access-group Wifi_access_in in interface Wifi timeout xlate 3:00:00 timeout pat-xlate 0:00:30 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 ldap attribute-map Group_Check map-name memberOf IETF-Radius-Class dynamic-access-policy-record DfltAccessPolicy aaa authentication http console LOCAL aaa authentication serial console LOCAL aaa authentication ssh console LOCAL aaa authentication telnet console LOCAL aaa authorization command LOCAL http server enable http 172.16.0.0 255.255.255.0 inside http 0.0.0.0 0.0.0.0 mts-out http 0.0.0.0 0.0.0.0 inside http redirect mts-out 80 no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart sysopt noproxyarp inside sysopt noproxyarp mts-out sysopt noproxyarp management telnet timeout 5 ssh 172.16.0.0 255.255.255.0 inside ssh timeout 5 ssh key-exchange group dh-group1-sha1 console timeout 0 no vpn-addr-assign dhcp no ipv6-vpn-addr-assign aaa no ipv6-vpn-addr-assign local dhcp-client client-id interface management dhcpd address 172.16.8.10-172.16.8.254 Wifi dhcpd dns 8.8.8.8 8.8.4.4 interface Wifi dhcpd enable Wifi ! dhcpd address 10.0.0.10-10.0.0.100 CORP dhcpd dns 172.16.0.254 8.8.8.8 interface CORP dhcpd enable CORP ! threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept ntp server 82.209.245.153 ssl encryption aes256-sha1 aes128-sha1 3des-sha1 dhe-aes128-sha1 dhe-aes256-sha1 ssl trust-point Global_External mts-out webvpn enable mts-out anyconnect-essentials anyconnect profiles New disk0:/new.xml anyconnect enable tunnel-group-list enable tunnel-group-preference group-url group-policy SSL_VPN internal group-policy SSL_VPN attributes dns-server value 172.16.0.254 vpn-simultaneous-logins 10 vpn-idle-timeout none vpn-session-timeout none vpn-tunnel-protocol ssl-client split-tunnel-policy tunnelspecified split-tunnel-network-list value Office_Allowed default-domain value strikerz-inc.com split-tunnel-all-dns disable address-pools value Office_VPN smartcard-removal-disconnect enable webvpn anyconnect ssl rekey time none anyconnect profiles value New type user anyconnect ask none default anyconnect customization value DfltCustomization always-on-vpn profile-setting group-policy DfltGrpPolicy attributes dns-server value 172.16.0.254 vpn-tunnel-protocol ikev1 l2tp-ipsec default-domain value strikerz-inc.com group-policy GroupPolicy1 internal group-policy GroupPolicy1 attributes vpn-tunnel-protocol ssl-clientless group-policy SOUND internal group-policy SOUND attributes wins-server none dns-server value 8.8.8.8 vpn-simultaneous-logins 3 vpn-idle-timeout 30 vpn-tunnel-protocol ssl-client split-tunnel-policy tunnelspecified split-tunnel-network-list value sound webvpn deny-message value Login was successful, but because certain criteria have not been met or due to some specific group policy, you do not have permission to use any of the VPN features. Contact your IT administrator for more information. username vpnm password Mu2HvbX9xenLqIVHN2gY1A== nt-encrypted username enerotov password U1oi5DrUcrFD.sS8 encrypted privilege 15 tunnel-group DefaultRAGroup general-attributes address-pool (inside) Office_VPN address-pool Office_VPN default-group-policy SSL_VPN tunnel-group DefaultWEBVPNGroup general-attributes address-pool Office_VPN tunnel-group SSL_VPN type remote-access tunnel-group SSL_VPN general-attributes address-pool (inside) Office_VPN address-pool Office_VPN authentication-server-group AD LOCAL default-group-policy SSL_VPN tunnel-group SSL_VPN webvpn-attributes group-alias strikerz-office enable tunnel-group SOUND type remote-access tunnel-group SOUND general-attributes address-pool Office_VPN authentication-server-group AD default-group-policy SOUND tunnel-group SOUND webvpn-attributes group-alias sound enable ! class-map global-class match access-list global_mpc class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum client auto message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect esmtp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp inspect ip-options policy-map global-policy class global-class flow-export event-type all destination 172.16.0.115 ! service-policy global_policy global : end
After adding this (in that order):
object network Rocket nat (any,mts-out) static interface service tcp 3000 8443 ! nat (inside,mts-out) after-auto source dynamic Local_Office_Network interface nat (inside,mts-out) after-auto source static any any
Now I can see the normal traffic between outside/inside (!!!):
Interesting picture, I just replaced outside IP in the packet tracer on the my white IP:
I added a rule as recommended:
nat (any,any) after-auto source static any Local_Office_Network destination static Local_Office_Network Local_Office_Network no-proxy-arp
and visually everything is OK:
But I sltill get from my home PC:
I have no options left)
