Static NAT not working properly in ASA firewall

[Eman.Bakri]

Hello all,

I am using cisco ASA 5515 with 9.2 image, I have to nat need to be implemented: 

first nat form inside interface to outside (For accessing internet from LAN), i am using PAT with outside interface ip (private ip given by service provider) this working perfect.

the next nat is for server in DMZ, i use STATIC nat (server must access internet and also must be accessible from internet in specific port), I saw hits in NAT and ACL but server donot working,

below are command used:

interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 10.100.10.2 255.255.255.0 (private ip given by ISP)
!
interface GigabitEthernet0/1
nameif inside
security-level 100
ip address 192.168.200.1 255.255.255.0 (LAN subnet)
!
interface GigabitEthernet0/2
nameif dmz
security-level 50
ip address 10.10.20.1 255.255.255.0 (dmz gateway)
!

object network inside_lan
subnet 192.168.200.0 255.255.255.0
object network public-ip (public IP given by ISP to use for server)
host X.X.X.X
object network server
host 10.10.20.100
!
access-list dmz-server extended permit tcp any host 10.10.20.100 eq ssh
access-list dmz-server extended permit ip host 10.10.20.100 any
access-list dmz-server extended permit ip 192.168.200.0 255.255.255.0 any
access-list dmz-server extended permit ip host X.X.X.X any
access-list dmz-server extended permit ip host 10.10.20.100 any
!
nat (inside,outside) source dynamic inside_lan interface
!

object network server
nat (dmz,outside) static public-ip
access-group dmz-server in interface outside
access-group dmz-server in interface dmz

route outside 0.0.0.0 0.0.0.0 10.100.10.1 1

show nat detail
Manual NAT Policies (Section 1)
1 (inside) to (outside) source dynamic inside_lan interface
translate_hits = 74641, untranslate_hits = 367
Source - Origin: 192.168.200.0/24, Translated: 10.100.10.2/24
2 (dmz) to (outside) source static server public-ip
translate_hits = 192, untranslate_hits = 0
Source - Origin: 10.10.20.100/32, Translated: X.X.X.X/32

Note: also I have hits in ACL line

access-list dmz-server extended permit ip host 10.10.20.100 any

but no hits from outside to server

please help me what is the issue?

Thanks in advance

[Georg Pauwen]

Hello,

the access list doesn't look right.

Try the configuration below:

object network public-ip
host X.X.X.X
!
object network server
host 10.10.20.100
!
object network server
nat (dmz,outside) static public-ip

!

access-list dmz-server extended permit ip any any
!
access-group dmz-server in interface dmz

[Eman.Bakri]

dear sir

Thanks for your reply,

I tried access list as you mention, it still not working.

[Georg Pauwen]

Hello,

what access list, if any, do you have applied to the outside interface ?

[balaji.bandi]

The syntax should work as expected as recommended, if not working

can you please provide the updated config along with below output :

1. #packet-tracer input outside tcp 10.10.20.100 80 10.100.10.2 80 ( thinking that your web server running 80, if 443 change to 443)

2. From internally you able to access the Server?  ( telnet 10.10.20.100 80 or 443)

[Eman.Bakri]

dear sir

Thanks for your reply,

I tried access list as you mention, it still not working.

[Eman.Bakri · Accepted solution]

Thanks all for your replies,

Now Static NAT is working good, the ACL was correct.

The issue is that the Public IP I used in Static NAT is configured as Secondary IP in ISP and not directly connected in my ASA, So when a user on the Internet will try to connect to some of your servers using the secondary public IP address space. The traffic will reach the ISP gateway which will see the public IP address as a part of a directly connected network. Now the ISP will send an ARP request that tells the ASA that the ARP requests senders IP address is from the secondary subnet and this secondary subnet is not an directly connected network to any ASA interface so the ASA wont populate its ARP table with the ISP gateway interfaces secondary IP/MAC where the ARP request came from or was sourced from. In other words ISP will never get an ARP reply from the ASA. And naturally when the ISP isnt able to determine the MAC address of the secondary subnets destination IP address the connections will fail.

After I enable below command, every thing working perfect:

arp permit-nonconnected

for more information about this issue refer to this helpful link:

https://community.cisco.com/t5/network-security/arp-permit-nonconnected/td-p/2226198

Thanks

[Georg Pauwen]

Very interesting ! Thanks for sharing that.