cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1454
Views
10
Helpful
7
Replies

Static NAT not working properly in ASA firewall

Eman.Bakri
Beginner
Beginner

Hello all,

I am using cisco ASA 5515 with 9.2 image, I have to nat need to be implemented: 

first nat form inside interface to outside (For accessing internet from LAN), i am using PAT with outside interface ip (private ip given by service provider) this working perfect.

the next nat is for server in DMZ, i use STATIC nat (server must access internet and also must be accessible from internet in specific port), I saw hits in NAT and ACL but server donot working,

below are command used:

 

 

 

interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 10.100.10.2 255.255.255.0 (private ip given by ISP)
!
interface GigabitEthernet0/1
nameif inside
security-level 100
ip address 192.168.200.1 255.255.255.0 (LAN subnet)
!
interface GigabitEthernet0/2
nameif dmz
security-level 50
ip address 10.10.20.1 255.255.255.0 (dmz gateway)
!

object network inside_lan
subnet 192.168.200.0 255.255.255.0
object network public-ip (public IP given by ISP to use for server)
host X.X.X.X
object network server
host 10.10.20.100
!
access-list dmz-server extended permit tcp any host 10.10.20.100 eq ssh
access-list dmz-server extended permit ip host 10.10.20.100 any
access-list dmz-server extended permit ip 192.168.200.0 255.255.255.0 any
access-list dmz-server extended permit ip host X.X.X.X any
access-list dmz-server extended permit ip host 10.10.20.100 any
!
nat (inside,outside) source dynamic inside_lan interface
!

object network server
nat (dmz,outside) static public-ip
access-group dmz-server in interface outside
access-group dmz-server in interface dmz

route outside 0.0.0.0 0.0.0.0 10.100.10.1 1


show nat detail
Manual NAT Policies (Section 1)
1 (inside) to (outside) source dynamic inside_lan interface
translate_hits = 74641, untranslate_hits = 367
Source - Origin: 192.168.200.0/24, Translated: 10.100.10.2/24
2 (dmz) to (outside) source static server public-ip
translate_hits = 192, untranslate_hits = 0
Source - Origin: 10.10.20.100/32, Translated: X.X.X.X/32

 

Note: also I have hits in ACL line

access-list dmz-server extended permit ip host 10.10.20.100 any

but no hits from outside to server

 

please help me what is the issue?

 

Thanks in advance

1 Accepted Solution

Accepted Solutions

Eman.Bakri
Beginner
Beginner

Thanks all for your replies,

Now Static NAT is working good, the ACL was correct.

The issue is that the Public IP I used in Static NAT is configured as Secondary IP in ISP and not directly connected in my ASA, So when a user on the Internet will try to connect to some of your servers using the secondary public IP address space. The traffic will reach the ISP gateway which will see the public IP address as a part of a directly connected network. Now the ISP will send an ARP request that tells the ASA that the ARP requests senders IP address is from the secondary subnet and this secondary subnet is not an directly connected network to any ASA interface so the ASA wont populate its ARP table with the ISP gateway interfaces secondary IP/MAC where the ARP request came from or was sourced from. In other words ISP will never get an ARP reply from the ASA. And naturally when the ISP isnt able to determine the MAC address of the secondary subnets destination IP address the connections will fail.

After I enable below command, every thing working perfect:

arp permit-nonconnected

for more information about this issue refer to this helpful link:

 

https://community.cisco.com/t5/network-security/arp-permit-nonconnected/td-p/2226198

 

Thanks

View solution in original post

7 Replies 7

Georg Pauwen
VIP Master VIP Master
VIP Master

Hello,

 

the access list doesn't look right.

 

Try the configuration below:

 

object network public-ip
host X.X.X.X
!
object network server
host 10.10.20.100
!
object network server
nat (dmz,outside) static public-ip

!

access-list dmz-server extended permit ip any any
!
access-group dmz-server in interface dmz

dear sir

Thanks for your reply,

I tried access list as you mention, it still not working.

Hello,

 

what access list, if any, do you have applied to the outside interface ?

balaji.bandi
VIP Community Legend VIP Community Legend
VIP Community Legend

The syntax should work as expected as recommended, if not working

 

can you please provide the updated config along with below output :

 

1. #packet-tracer input outside tcp 10.10.20.100 80 10.100.10.2 80 ( thinking that your web server running 80, if 443 change to 443)

2. From internally you able to access the Server?  ( telnet 10.10.20.100 80 or 443)

 

 

 

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

Eman.Bakri
Beginner
Beginner

dear sir

Thanks for your reply,

I tried access list as you mention, it still not working.

Eman.Bakri
Beginner
Beginner

Thanks all for your replies,

Now Static NAT is working good, the ACL was correct.

The issue is that the Public IP I used in Static NAT is configured as Secondary IP in ISP and not directly connected in my ASA, So when a user on the Internet will try to connect to some of your servers using the secondary public IP address space. The traffic will reach the ISP gateway which will see the public IP address as a part of a directly connected network. Now the ISP will send an ARP request that tells the ASA that the ARP requests senders IP address is from the secondary subnet and this secondary subnet is not an directly connected network to any ASA interface so the ASA wont populate its ARP table with the ISP gateway interfaces secondary IP/MAC where the ARP request came from or was sourced from. In other words ISP will never get an ARP reply from the ASA. And naturally when the ISP isnt able to determine the MAC address of the secondary subnets destination IP address the connections will fail.

After I enable below command, every thing working perfect:

arp permit-nonconnected

for more information about this issue refer to this helpful link:

 

https://community.cisco.com/t5/network-security/arp-permit-nonconnected/td-p/2226198

 

Thanks

Very interesting ! Thanks for sharing that.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers