VPN issue and NAT problem on ASA

[jkay18041]

We recently moved our HR dept to it's own vlan and since doing that I am unable to get RDP to work to the HR computers from the VPN. I was hoping someone could help. I don't fully understand the nat rule order, if I move the HR dept to the bottom of the list RDP works but DNS breaks.

If I leave it where it's at now and I am on the ASDM and look at the monitoring feature I show the following message.

5

May 08 2019

21:27:32

10.245.245.10

10561

10.15.4.24

3389

Asymmetric NAT rules matched for forward and reverse flows; Connection for tcp src outside:10.245.245.10/10561(LOCAL\john) dst HR_Dept:10.15.4.24/3389 denied due to NAT reverse path failure

Any ideas on how I can fix it?

Here is my config

name 10.245.245.0 VPN_IP_Pool
name 10.16.235.0 HS_ATPAP
name 10.15.2.192 ssweb
dns-guard
no mac-address auto
ip local pool company-VPN-Pool 10.245.245.10-10.245.245.199 mask 255.255.255.0

!
interface GigabitEthernet1/1
nameif outside
security-level 0
ip address 4.5.6.66 255.255.255.192
!
interface GigabitEthernet1/2
nameif inside
security-level 100
ip address 10.15.2.251 255.255.255.0
!
interface GigabitEthernet1/3
nameif voice
security-level 90
ip address 192.168.20.251 255.255.255.0
!
interface GigabitEthernet1/4
description Corp WiFi Interface
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/4.33
description Printer
vlan 33
nameif Printers
security-level 100
ip address 10.15.33.251 255.255.255.0
!
interface GigabitEthernet1/5
nameif LW_WiFi
security-level 100
ip address 10.15.3.251 255.255.255.0
!
interface GigabitEthernet1/6
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/6.4
description HR Department
vlan 4
nameif HR_Dept
security-level 100
ip address 10.15.4.251 255.255.255.0
!
interface GigabitEthernet1/7
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/8
nameif To_5516
security-level 0
ip address 192.168.95.2 255.255.255.252
!
interface Management1/1
management-only
no nameif
no security-level
no ip address
!
boot system disk0:/asa9-12-1-lfbff-k8.SPA
boot system disk0:/asa9101-lfbff-k8.SPA
ftp mode passive
clock timezone CST -6
clock summer-time CDT recurring
dns domain-lookup outside
dns domain-lookup inside
dns domain-lookup voice
dns domain-lookup LW_WiFi
dns domain-lookup HR_Dept
dns server-group DefaultDNS
domain-name company.corp
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network VPN_IP_Pool
subnet 10.245.245.0 255.255.255.0
object network company_Internal_Range
subnet 10.15.2.0 255.255.255.0
object network obj-10.0.0.0
subnet 10.0.0.0 255.0.0.0
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network ScreenConnect
object network 4.5.6.86
host 4.5.6.86
object network 4.5.6.67
host 4.5.6.67
object network 4.5.6.94
host 4.5.6.94
object service aamon
service tcp destination eq 10101
object service aamob1
service udp destination eq isakmp
description AA Mobility
object service aamob2
service udp destination eq 4500
description AA Mobility
object network ForecastTool
host 10.15.2.54
description Internal Address of Forecast Tool
object network ForecastTool-Ext
host 4.5.6.69
description External Address of Forecast Tool
object service forecasttl
service tcp destination eq www
description Allow port 7171 on forecast tool
object network NETWORK_OBJ_10.245.245.0_24
subnet 10.245.245.0 255.255.255.0
object network Spiceworks
host 10.15.2.183
description Internal Address of Spiceworks Site
object network Printer-External-IP
host 4.5.6.70
description Printer IP
object service Spiceworks-9675
service tcp destination eq 9675
description Permit TCP 9675
object network company_Voice_Range
subnet 192.168.20.0 255.255.255.0
description voice IP range
object network Voice_NAT
host 4.5.6.71
description Voice_NAT
object network Google_DNS_1
host 8.8.8.8
description Google_DNS_1
object network Google_DNS_2
host 8.8.4.4
description Google_DNS_2
object service DHCP_Relay
service udp destination eq bootps
object service GoverLAN-agents
service tcp destination eq 15155
description Allow GoverLAN agents to 15155
object network DMZ_NAT_IP
host 4.5.6.79
object network DMZ_Internal_Range
subnet 192.168.10.0 255.255.255.0
object network DMZ-2_Internal_Range
subnet 172.16.52.0 255.255.255.0
object network DMZ-2_NAT_IP
host 4.5.6.81
object network Nextiva_Block_1
subnet 208.73.144.0 255.255.248.0
object network DMZ_Radius
host 192.168.10.254
object service RDP-Service
service tcp source eq 3395
object network nextiva_background_images
subnet 151.101.48.0 255.255.255.0
description website
object network Nextiva_Block_2
subnet 208.89.108.0 255.255.252.0
object service LWNAS_443
service tcp source range 1 65000 destination eq https
description LWNAS
object network LWNAS
host 10.15.2.55
object network LWNAS-EXT
host 4.5.6.74
description External Address of LWNAS
object network VPN
host 4.5.6.66
description VPN public IP
object network LW_WiFi
subnet 10.15.3.0 255.255.255.0
description LW_WiFi
object network HR_Dept
subnet 10.15.4.0 255.255.255.0
description HR department
object network HR_Public_IP
host 4.5.6.68
description HR
object service Radius
service udp source range 0 50000 destination eq 1814
object network NETWORK_OBJ_10.30.97.0_24
subnet 10.30.97.0 255.255.255.0
object network NETWORK_OBJ_10.15.2.0_24
subnet 10.15.2.0 255.255.255.0
object network Printers
subnet 10.15.33.0 255.255.255.0
description Printer VLAN
object network ICTDC01
host 10.15.2.1
description ICTDC01
object network ICTDC03
host 10.15.2.3
description ICTDC03
object network ICTDC06
host 10.15.2.6
description ICTDC06
object-group protocol TCPUDP
protocol-object udp
protocol-object tcp
object-group service RDP tcp-udp
port-object eq 3389
object-group network Google_DNS_Group
network-object object Google_DNS_1
network-object object Google_DNS_2
object-group service DM_INLINE_TCP_20 tcp
port-object eq ftp
port-object eq ftp-data
object-group network DM_INLINE_NETWORK_2
object-group service DM_INLINE_SERVICE_12
service-object icmp
service-object tcp destination eq ftp
service-object tcp destination eq ftp-data
object-group protocol DM_INLINE_PROTOCOL_3
protocol-object ip
protocol-object icmp
object-group network PrivateNetworks
network-object 10.0.0.0 255.0.0.0
object-group network USG_Networks_To_Block
description Guest - Networks to block
network-object object company_Internal_Range
network-object object company_Voice_Range
network-object object VPN_IP_Pool
network-object 10.15.3.0 255.255.255.0
network-object 10.15.4.0 255.255.255.0
network-object object HR_Dept
network-object object HR_Public_IP
network-object 10.0.0.0 255.0.0.0
object-group service time-servers udp
port-object eq ntp
object-group network Nextiva_IP_Ranges
network-object object Nextiva_Block_1
group-object Google_DNS_Group
network-object object Nextiva_Block_2
object-group service DM_INLINE_TCP_1 tcp
port-object eq www
port-object eq https
object-group service DM_INLINE_SERVICE_1
service-object tcp-udp destination eq sip
service-object udp destination eq sip
object-group service DM_INLINE_SERVICE_2
service-object ip
service-object tcp
service-object object LWNAS_443
object-group service mDNS udp
description udp 5353
port-object eq 5353
object-group protocol DM_INLINE_PROTOCOL_1
protocol-object ip
protocol-object icmp
object-group protocol DM_INLINE_PROTOCOL_2
protocol-object ip
protocol-object icmp
object-group network Domain_Controllers
description ICT Domain Controllers
network-object object ICTDC01
network-object object ICTDC03
network-object object ICTDC06
object-group protocol DM_INLINE_PROTOCOL_4
protocol-object ip
protocol-object icmp
object-group service DM_INLINE_TCP_2 tcp
group-object RDP
port-object eq ftp
port-object eq www
port-object eq https
port-object eq ssh
access-list inside_nat0_outbound extended permit ip any object VPN_IP_Pool
access-list outside_access_in extended deny udp any object DMZ_Radius eq 5353
access-list outside_access_in extended permit icmp any any
access-list outside_access_in extended permit icmp any 10.15.2.0 255.255.255.0
access-list outside_access_in extended permit object forecasttl any4 object ForecastTool
access-list outside_access_in extended permit ip any object LWNAS
access-list 110 extended permit ip 10.0.0.0 255.0.0.0 object VPN_IP_Pool
access-list inside_access_in_1 extended permit ip 10.15.2.0 255.255.255.0 any
access-list inside_access_in extended permit ip any any
access-list ASA-Sourcefire extended permit ip any any inactive
access-list company-VPN-Split-Tunnel standard permit 10.15.0.0 255.255.0.0
access-list voice_access_in extended deny ip object-group PrivateNetworks any
access-list voice_access_in extended permit tcp 192.168.20.0 255.255.255.0 object nextiva_background_images object-group DM_INLINE_TCP_1
access-list voice_access_in extended permit object-group DM_INLINE_SERVICE_1 192.168.20.0 255.255.255.0 any
access-list voice_access_in extended permit object-group DM_INLINE_PROTOCOL_2 192.168.20.0 255.255.255.0 object-group Nextiva_IP_Ranges
access-list voice_access_in extended permit udp any any eq ntp
access-list voice_access_in extended deny ip any any log debugging
access-list voice_access_in extended deny icmp any any inactive
access-list To_5516_access_in extended permit object-group DM_INLINE_PROTOCOL_4 any object-group Domain_Controllers
access-list To_5516_access_in extended permit object-group TCPUDP any object-group Domain_Controllers eq domain
access-list To_5516_access_in extended deny ip any any
access-list To_5516_access_in extended deny tcp any any object-group DM_INLINE_TCP_2
access-list To_5516_access_in extended deny tcp any any eq lpd
access-list DMZ_access_in extended permit ip any any
access-list DMZ-2_access_in extended deny ip any any inactive
access-list AnyConnect_Client_Local_Print extended deny ip any4 any4
access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq lpd
access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol
access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 631
access-list AnyConnect_Client_Local_Print remark Windows' printing port
access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 9100
access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol
access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.251 eq 5353
access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol
access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.252 eq 5355
access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol
access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 137
access-list AnyConnect_Client_Local_Print extended permit udp any4 any4 eq netbios-ns
access-list from_outside extended permit icmp any any echo
access-list LW_WiFi_access_in extended deny ip any 192.168.20.0 255.255.255.0
access-list LW_WiFi_access_in extended deny ip any 10.15.4.0 255.255.255.0
access-list LW_WiFi_access_in extended permit ip any any
access-list HR_Dept_access_in extended deny ip any 192.168.100.0 255.255.255.0
access-list HR_Dept_access_in extended deny ip any 192.168.20.0 255.255.255.0
access-list HR_Dept_access_in extended deny ip any 10.15.3.0 255.255.255.0
access-list HR_Dept_access_in extended permit ip any any
access-list Printers_access_in extended permit object-group DM_INLINE_PROTOCOL_1 any any
!
tcp-map tmap
invalid-ack allow
seq-past-window allow
tcp-options md5 clear
!
pager lines 24
logging enable
logging timestamp
logging asdm-buffer-size 200
logging buffered debugging
logging trap warnings
logging asdm debugging
logging host inside 10.15.2.226
mtu outside 1500
mtu inside 1500
mtu voice 1500
mtu Printers 1500
mtu LW_WiFi 1500
mtu HR_Dept 1500
mtu To_5516 1500
no failover
no monitor-interface Printers
no monitor-interface HR_Dept
no monitor-interface service-module
icmp unreachable rate-limit 1 burst-size 1
icmp permit any outside
icmp permit any inside
asdm image disk0:/asdm-7121.bin
no asdm history enable
arp timeout 14400
arp permit-nonconnected
arp rate-limit 16384
nat (inside,outside) source static any any destination static NETWORK_OBJ_10.245.245.0_24 NETWORK_OBJ_10.245.245.0_24 no-proxy-arp route-lookup
nat (voice,outside) source static company_Voice_Range Voice_NAT description Voice_NAT_Rule
nat (HR_Dept,any) source static HR_Dept HR_Public_IP
nat (LW_WiFi,any) source static LW_WiFi 4.5.6.67
!
object network obj_any
nat (inside,outside) dynamic interface
object network ForecastTool
nat (inside,outside) static ForecastTool-Ext
object network LWNAS
nat (inside,outside) static LWNAS-EXT service tcp 5001 https
!
nat (Printers,outside) after-auto source static Printers Printer-External-IP
access-group outside_access_in in interface outside
access-group inside_access_in_1 in interface inside control-plane
access-group inside_access_in in interface inside
access-group voice_access_in in interface voice
access-group Printers_access_in in interface Printers
access-group LW_WiFi_access_in in interface LW_WiFi
access-group HR_Dept_access_in in interface HR_Dept
access-group To_5516_access_in in interface To_5516
route outside 0.0.0.0 0.0.0.0 4.5.6.65 1
route To_5516 10.16.1.0 255.255.255.0 192.168.95.1 1

[Francesco Molino]

Hi

Can you remove the following nat:

nat (inside,outside) source static any any destination static NETWORK_OBJ_10.245.245.0_24 NETWORK_OBJ_10.245.245.0_24 no-proxy-arp route-lookup

And replace it with the following:

nat (inside,outside) source static  company_Internal_Range  company_Internal_Range destination static NETWORK_OBJ_10.245.245.0_24 NETWORK_OBJ_10.245.245.0_24 no-proxy-arp route-lookup

nat (HR_Dept,outside) source static HR_Dept HR_Dept destination static NETWORK_OBJ_10.245.245.0_24 NETWORK_OBJ_10.245.245.0_24 no-proxy-arp route-lookup

[jkay18041]

When I made those changes via the cmd line I watched it on the ASDM and it changed the order of the nat rules.

For some reason that didn't work, it killed all internet on the HR dept vlan and then I still got the same error message when trying to rdp.

Thanks for your help with this.

[Francesco Molino]

The goal wasn't to replace it like this by copying it into your cli but to show you the change you have need to made. I'm sorry if it wasn't clear enough.

If you want  to replace by copying it into your CLI, you need to set the order number.

Normally your actual nat (exempt nat) is in position 1 on your nat order then the new config should looks like as follow 

nat (inside,outside) 1 source static  company_Internal_Range  company_Internal_Range destination static NETWORK_OBJ_10.245.245.0_24 NETWORK_OBJ_10.245.245.0_24 no-proxy-arp route-lookup

nat (HR_Dept,outside) 2 source static HR_Dept HR_Dept destination static NETWORK_OBJ_10.245.245.0_24 NETWORK_OBJ_10.245.245.0_24 no-proxy-arp route-lookup

[jkay18041]

I tried it by putting them in 1 and 2 for nat and it broke HR again. I then made a change to the first rule and changed comany_internal_range from 10.15.2.0 255.255.255.0 to 10.15.0.0 255.255.248.0 and that let HR access the internet where as when the hr nat exempt rule was in place it wouldn't.

With that being said are my other nat rules out of order? I don't fully understand the order as by me re arranging them I can get RDP to work to HR but then it breaks HR internet or others internet. With the config I put below HR gets internet but no RDP.

Any advice?

name 67.17.205.220 MPLS205
name 67.17.154.248 MPLS154
name 67.17.153.0 MPLS153
name 67.17.152.0 MPLS152
name 10.245.245.0 VPN_IP_Pool
name 10.16.235.0 HS_ATPAP
name 10.15.2.192 ssweb
dns-guard
no mac-address auto
ip local pool company-VPN-Pool 10.245.245.10-10.245.245.199 mask 255.255.255.0

!
interface GigabitEthernet1/1
nameif outside
security-level 0
ip address 85.85.85.66 255.255.255.192
!
interface GigabitEthernet1/2
nameif inside
security-level 100
ip address 10.15.2.251 255.255.255.0
!
interface GigabitEthernet1/3
nameif voice
security-level 90
ip address 192.168.20.251 255.255.255.0
!
interface GigabitEthernet1/4
description Corp WiFi Interface
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/4.33
description Printer
vlan 33
nameif Printers
security-level 100
ip address 10.15.33.251 255.255.255.0
!
interface GigabitEthernet1/5
nameif LW_WiFi
security-level 100
ip address 10.15.3.251 255.255.255.0
!
interface GigabitEthernet1/6
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/6.4
description HR Department
vlan 4
nameif HR_Dept
security-level 100
ip address 10.15.4.251 255.255.255.0
!
interface GigabitEthernet1/7
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/8
nameif To_5516
security-level 0
ip address 192.168.95.2 255.255.255.252
!
interface Management1/1
management-only
no nameif
no security-level
no ip address
!
boot system disk0:/asa9-12-1-lfbff-k8.SPA
boot system disk0:/asa9101-lfbff-k8.SPA
ftp mode passive
clock timezone CST -6
clock summer-time CDT recurring
dns domain-lookup outside
dns domain-lookup inside
dns domain-lookup voice
dns domain-lookup LW_WiFi
dns domain-lookup HR_Dept
dns server-group DefaultDNS
domain-name company.corp
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network VPN_IP_Pool
subnet 10.245.245.0 255.255.255.0
object network company_Internal_Range
subnet 10.15.0.0 255.255.248.0
object network obj-10.0.0.0
subnet 10.0.0.0 255.0.0.0
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network ScreenConnect
object network 85.85.85.86
host 85.85.85.86
object network 85.85.85.67
host 85.85.85.67
object network 85.85.85.94
host 85.85.85.94
object service aamon
service tcp destination eq 10101
object service aamob1
service udp destination eq isakmp
description AA Mobility
object service aamob2
service udp destination eq 4500
description AA Mobility
object network ForecastTool
host 10.15.2.54
description Internal Address of Forecast Tool
object network ForecastTool-Ext
host 85.85.85.69
description External Address of Forecast Tool
object service forecasttl
service tcp destination eq www
description Allow port 7171 on forecast tool
object network NETWORK_OBJ_10.245.245.0_24
subnet 10.245.245.0 255.255.255.0
object network Spiceworks
host 10.15.2.183
description Internal Address of Spiceworks Site
object network Printer-External-IP
host 85.85.85.70
description Printer IP
object service Spiceworks-9675
service tcp destination eq 9675
description Permit TCP 9675
object network company_Voice_Range
subnet 192.168.20.0 255.255.255.0
description voice IP range
object network Voice_NAT
host 85.85.85.71
description Voice_NAT
object network Google_DNS_1
host 8.8.8.8
description Google_DNS_1
object network Google_DNS_2
host 8.8.4.4
description Google_DNS_2
object service DHCP_Relay
service udp destination eq bootps
object service GoverLAN-agents
service tcp destination eq 15155
description Allow GoverLAN agents to 15155
object network DMZ_NAT_IP
host 85.85.85.79
object network DMZ_Internal_Range
subnet 192.168.10.0 255.255.255.0
object network DMZ-2_Internal_Range
subnet 172.16.52.0 255.255.255.0
object network DMZ-2_NAT_IP
host 85.85.85.81
object network Nextiva_Block_1
subnet 208.73.144.0 255.255.248.0
object network DMZ_Radius
host 192.168.10.254
object service RDP-Service
service tcp source eq 3395
object network nextiva_background_images
subnet 151.101.48.0 255.255.255.0
description website
object network Nextiva_Block_2
subnet 208.89.108.0 255.255.252.0
object service LWNAS_443
service tcp source range 1 65000 destination eq https
description LWNAS
object network LWNAS
host 10.15.2.55
object network LWNAS-EXT
host 85.85.85.74
description External Address of LWNAS
object network VPN
host 85.85.85.66
description VPN public IP
object network LW_WiFi
subnet 10.15.3.0 255.255.255.0
description LW_WiFi
object network HR_Dept
subnet 10.15.4.0 255.255.255.0
description HR department
object network HR_Public_IP
host 85.85.85.68
description HR
object service Radius
service udp source range 0 50000 destination eq 1814
object network NETWORK_OBJ_10.30.97.0_24
subnet 10.30.97.0 255.255.255.0
object network NETWORK_OBJ_10.15.2.0_24
subnet 10.15.2.0 255.255.255.0
object network Printers
subnet 10.15.33.0 255.255.255.0
description Printer VLAN
object network ICTDC01
host 10.15.2.1
description ICTDC01
object network ICTDC03
host 10.15.2.3
description ICTDC03
object network ICTDC06
host 10.15.2.6
description ICTDC06
object-group protocol TCPUDP
protocol-object udp
protocol-object tcp
object-group service RDP tcp-udp
port-object eq 3389
object-group network Google_DNS_Group
network-object object Google_DNS_1
network-object object Google_DNS_2
object-group service DM_INLINE_TCP_20 tcp
port-object eq ftp
port-object eq ftp-data
object-group network DM_INLINE_NETWORK_2
object-group service DM_INLINE_SERVICE_12
service-object icmp
service-object tcp destination eq ftp
service-object tcp destination eq ftp-data
object-group protocol DM_INLINE_PROTOCOL_3
protocol-object ip
protocol-object icmp
object-group network PrivateNetworks
network-object 10.0.0.0 255.0.0.0
object-group network USG_Networks_To_Block
description Guest - Networks to block
network-object object company_Voice_Range
network-object object VPN_IP_Pool
network-object 10.15.3.0 255.255.255.0
network-object 10.15.4.0 255.255.255.0
network-object object HR_Dept
network-object object HR_Public_IP
network-object 10.0.0.0 255.0.0.0
network-object object company_Internal_Range
object-group service time-servers udp
port-object eq ntp
object-group network Nextiva_IP_Ranges
network-object object Nextiva_Block_1
group-object Google_DNS_Group
network-object object Nextiva_Block_2
object-group service DM_INLINE_TCP_1 tcp
port-object eq www
port-object eq https
object-group service DM_INLINE_SERVICE_1
service-object tcp-udp destination eq sip
service-object udp destination eq sip
object-group service DM_INLINE_SERVICE_2
service-object ip
service-object tcp
service-object object LWNAS_443
object-group service mDNS udp
description udp 5353
port-object eq 5353
object-group protocol DM_INLINE_PROTOCOL_1
protocol-object ip
protocol-object icmp
object-group protocol DM_INLINE_PROTOCOL_2
protocol-object ip
protocol-object icmp
object-group network Domain_Controllers
description ICT Domain Controllers
network-object object ICTDC01
network-object object ICTDC03
network-object object ICTDC06
object-group protocol DM_INLINE_PROTOCOL_4
protocol-object ip
protocol-object icmp
object-group service DM_INLINE_TCP_2 tcp
group-object RDP
port-object eq ftp
port-object eq www
port-object eq https
port-object eq ssh
access-list inside_nat0_outbound extended permit ip any object VPN_IP_Pool
access-list outside_access_in extended deny udp any object DMZ_Radius eq 5353
access-list outside_access_in extended permit icmp any any
access-list outside_access_in extended permit icmp any 10.15.2.0 255.255.255.0
access-list outside_access_in extended permit object forecasttl any4 object ForecastTool
access-list outside_access_in extended permit ip any object LWNAS
access-list 110 extended permit ip 10.0.0.0 255.0.0.0 object VPN_IP_Pool
access-list inside_access_in_1 extended permit ip 10.15.2.0 255.255.255.0 any
access-list inside_access_in extended permit ip any any
access-list ASA-Sourcefire extended permit ip any any inactive
access-list company-VPN-Split-Tunnel standard permit 10.15.0.0 255.255.0.0
access-list voice_access_in extended deny ip object-group PrivateNetworks any
access-list voice_access_in extended permit tcp 192.168.20.0 255.255.255.0 object nextiva_background_images object-group DM_INLINE_TCP_1
access-list voice_access_in extended permit object-group DM_INLINE_SERVICE_1 192.168.20.0 255.255.255.0 any
access-list voice_access_in extended permit object-group DM_INLINE_PROTOCOL_2 192.168.20.0 255.255.255.0 object-group Nextiva_IP_Ranges
access-list voice_access_in extended permit udp any any eq ntp
access-list voice_access_in extended deny ip any any log debugging
access-list voice_access_in extended deny icmp any any inactive
access-list To_5516_access_in extended permit object-group DM_INLINE_PROTOCOL_4 any object-group Domain_Controllers
access-list To_5516_access_in extended permit object-group TCPUDP any object-group Domain_Controllers eq domain
access-list To_5516_access_in extended deny ip any any
access-list To_5516_access_in extended deny tcp any any object-group DM_INLINE_TCP_2
access-list To_5516_access_in extended deny tcp any any eq lpd
access-list DMZ_access_in extended permit ip any any
access-list DMZ-2_access_in extended deny ip any any inactive
access-list AnyConnect_Client_Local_Print extended deny ip any4 any4
access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq lpd
access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol
access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 631
access-list AnyConnect_Client_Local_Print remark Windows' printing port
access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 9100
access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol
access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.251 eq 5353
access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol
access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.252 eq 5355
access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol
access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 137
access-list AnyConnect_Client_Local_Print extended permit udp any4 any4 eq netbios-ns
access-list from_outside extended permit icmp any any echo
access-list LW_WiFi_access_in extended deny ip any 192.168.20.0 255.255.255.0
access-list LW_WiFi_access_in extended deny ip any 10.15.4.0 255.255.255.0
access-list LW_WiFi_access_in extended permit ip any any
access-list HR_Dept_access_in extended deny ip any 192.168.100.0 255.255.255.0
access-list HR_Dept_access_in extended deny ip any 192.168.20.0 255.255.255.0
access-list HR_Dept_access_in extended deny ip any 10.15.3.0 255.255.255.0
access-list HR_Dept_access_in extended permit ip any any
access-list Printers_access_in extended permit object-group DM_INLINE_PROTOCOL_1 any any
!
tcp-map tmap
invalid-ack allow
seq-past-window allow
tcp-options md5 clear
!
pager lines 24
logging enable
logging timestamp
logging asdm-buffer-size 200
logging buffered debugging
logging trap warnings
logging asdm debugging
logging host inside 10.15.2.226
mtu outside 1500
mtu inside 1500
mtu voice 1500
mtu Printers 1500
mtu LW_WiFi 1500
mtu HR_Dept 1500
mtu To_5516 1500
no failover
no monitor-interface Printers
no monitor-interface HR_Dept
no monitor-interface service-module
icmp unreachable rate-limit 1 burst-size 1
icmp permit any outside
icmp permit any inside
asdm image disk0:/asdm-7121.bin
no asdm history enable
arp timeout 14400
arp permit-nonconnected
arp rate-limit 16384
nat (inside,outside) source static company_Internal_Range company_Internal_Range destination static NETWORK_OBJ_10.245.245.0_24 NETWORK_OBJ_10.245.245.0_24 no-proxy-arp route-lookup
nat (voice,outside) source static company_Voice_Range Voice_NAT description Voice_NAT_Rule
nat (HR_Dept,any) source static HR_Dept HR_Public_IP
nat (LW_WiFi,any) source static LW_WiFi 85.85.85.67
!
object network obj_any
nat (inside,outside) dynamic interface
object network ForecastTool
nat (inside,outside) static ForecastTool-Ext
object network LWNAS
nat (inside,outside) static LWNAS-EXT service tcp 5001 https
!
nat (Printers,outside) after-auto source static Printers Printer-External-IP
access-group outside_access_in in interface outside
access-group inside_access_in_1 in interface inside control-plane
access-group inside_access_in in interface inside
access-group voice_access_in in interface voice
access-group Printers_access_in in interface Printers
access-group LW_WiFi_access_in in interface LW_WiFi
access-group HR_Dept_access_in in interface HR_Dept
access-group To_5516_access_in in interface To_5516
route outside 0.0.0.0 0.0.0.0 85.85.85.65 1
route To_5516 10.16.1.0 255.255.255.0 192.168.95.1 1

[Francesco Molino · Accepted solution]

Ok that's weird you're loosing internet access if these 2 rules are at the top, this is what numbers 1 and 2 does.

You have 3 categories of nat:

 - Type 1: Manual NAT (or twice nat with higest Preference)

 - Type 2: Auto NAT (Network Object NAT)

 - Type 3: Manual NAT (or twice nat with lowest Preference)

The 2 below nats, I would suggest to convert them into object NAT or move at the lowest preference. You don't have any manual nat type 3, then I will go with Network object nat. Also I would avoid to have any as destination zone interface and specify outside because you want to nat these networks when going out to internet.

nat (HR_Dept,any) source static HR_Dept HR_Public_IP
nat (LW_WiFi,any) source static LW_WiFi 85.85.85.67

The config with object nat will look like:

object network HR_Dept
 subnet 10.15.4.0 255.255.255.0
 description HR department

 nat (HR_Dept,outside) static HR_Public_IP

!

object network LW_WiFi
 subnet 10.15.3.0 255.255.255.0
 description LW_WiFi

 nat (HR_Dept,outside) static 85.85.85.67

After you paste the previous config I gave you, can you confirm the 2 nats were at the top of the list on your asdm?

You can also run the command show nat on your asa and you should see the 2 nat for VPN as the top one.

[jkay18041]

Awesome, that makes a lot more sense. Thank you so much for your help. I was able to get it working by using them as object nat like you suggested.

Thank you!

[Francesco Molino]

You're welcome!

[jkay18041]

I noticed this morning that after I made the NAT changes I can no longer access SNMP and other services that are on public IP's in my /26 range. I have a guest network firewall that I am unable to reach from my inside network via it's public IP. Since these are public IP's how would the NAT rules of changed them?

When I use the Packet trace utility in ASDM and try to send a packet from the inside interface to the public IP of my Guest Network router it says :(no-adjacency) No valid adjacency

Thanks for all your help

[Francesco Molino]

Can you share the packet tracer output please and give more information on what IP are you trying to access over snmp and from where?

[jkay18041]

Here is the current config

xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
no names
name 10.245.245.0 VPN_IP_Pool
name 10.16.235.0 HS_ATPAP
name 10.15.2.192 ssweb
dns-guard
no mac-address auto
ip local pool company-VPN-Pool 10.245.245.10-10.245.245.199 mask 255.255.255.0

!
interface GigabitEthernet1/1
nameif outside
security-level 0
ip address 75.75.75.66 255.255.255.192
!
interface GigabitEthernet1/2
nameif inside
security-level 100
ip address 10.15.2.251 255.255.255.0
!
interface GigabitEthernet1/3
nameif voice
security-level 90
ip address 192.168.20.251 255.255.255.0
!
interface GigabitEthernet1/4
description Corp WiFi Interface
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/4.33
description Printer
vlan 33
nameif Printers
security-level 100
ip address 10.15.33.251 255.255.255.0
!
interface GigabitEthernet1/5
nameif LW_WiFi
security-level 100
ip address 10.15.3.251 255.255.255.0
!
interface GigabitEthernet1/6
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/6.4
description HR Department
vlan 4
nameif HR_Dept
security-level 100
ip address 10.15.4.251 255.255.255.0
!
interface GigabitEthernet1/7
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/8
nameif To_5516
security-level 0
ip address 192.168.95.2 255.255.255.252
!
interface Management1/1
management-only
no nameif
no security-level
no ip address
!
boot system disk0:/asa9-12-1-lfbff-k8.SPA
boot system disk0:/asa9101-lfbff-k8.SPA
ftp mode passive
clock timezone CST -6
clock summer-time CDT recurring
dns domain-lookup outside
dns domain-lookup inside
dns domain-lookup voice
dns domain-lookup LW_WiFi
dns domain-lookup HR_Dept
dns server-group DefaultDNS
domain-name company.corp
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network VPN_IP_Pool
subnet 10.245.245.0 255.255.255.0
object network company_Internal_Range
subnet 10.15.2.0 255.255.255.0
object network obj-10.0.0.0
subnet 10.0.0.0 255.0.0.0
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network ScreenConnect
object network 75.75.75.86
host 75.75.75.86
object network 75.75.75.67
host 75.75.75.67
object network 75.75.75.94
host 75.75.75.94
object service aamon
service tcp destination eq 10101
object service aamob1
service udp destination eq isakmp
description AA Mobility
object service aamob2
service udp destination eq 4500
description AA Mobility
object network ForecastTool
host 10.15.2.54
description Internal Address of Forecast Tool
object network ForecastTool-Ext
host 75.75.75.69
description External Address of Forecast Tool
object service forecasttl
service tcp destination eq www
description Allow port 7171 on forecast tool
object network NETWORK_OBJ_10.245.245.0_24
subnet 10.245.245.0 255.255.255.0
object network Spiceworks
host 10.15.2.183
description Internal Address of Spiceworks Site
object network Printer-External-IP
host 75.75.75.70
description Printer IP
object service Spiceworks-9675
service tcp destination eq 9675
description Permit TCP 9675
object network company_Voice_Range
subnet 192.168.20.0 255.255.255.0
description voice IP range
object network Voice_NAT
host 75.75.75.71
description Voice_NAT
object network Google_DNS_1
host 8.8.8.8
description Google_DNS_1
object network Google_DNS_2
host 8.8.4.4
description Google_DNS_2
object service DHCP_Relay
service udp destination eq bootps
object service GoverLAN-agents
service tcp destination eq 15155
description Allow GoverLAN agents to 15155
object network DMZ_NAT_IP
host 75.75.75.79
object network DMZ_Internal_Range
subnet 192.168.10.0 255.255.255.0
object network DMZ-2_Internal_Range
subnet 172.16.52.0 255.255.255.0
object network DMZ-2_NAT_IP
host 75.75.75.81
object network Nextiva_Block_1
subnet 208.73.144.0 255.255.248.0
object network DMZ_Radius
host 192.168.10.254
object service RDP-Service
service tcp source eq 3395
object network nextiva_background_images
subnet 151.101.48.0 255.255.255.0
description website
object network Nextiva_Block_2
subnet 208.89.108.0 255.255.252.0
object service LWNAS_443
service tcp source range 1 65000 destination eq https
description LWNAS
object network LWNAS
host 10.15.2.55
object network LWNAS-EXT
host 75.75.75.74
description External Address of LWNAS
object network VPN
host 75.75.75.66
description VPN public IP
object network LW_WiFi
subnet 10.15.3.0 255.255.255.0
description LW_WiFi
object network HR_Dept
subnet 10.15.4.0 255.255.255.0
description HR department
object network HR_Public_IP
host 75.75.75.68
description HR
object service Radius
service udp source range 0 50000 destination eq 1814
object network NETWORK_OBJ_10.30.97.0_24
subnet 10.30.97.0 255.255.255.0
object network NETWORK_OBJ_10.15.2.0_24
subnet 10.15.2.0 255.255.255.0
object network Printers
subnet 10.15.33.0 255.255.255.0
description Printer VLAN
object network ICTDC01
host 10.15.2.1
description ICTDC01
object network ICTDC03
host 10.15.2.3
description ICTDC03
object network ICTDC06
host 10.15.2.6
description ICTDC06
object network HR_Nat
subnet 10.15.4.0 255.255.255.0
description HR Dept
object network Corp_WiFi
subnet 10.15.3.0 255.255.255.0
description LW Corp WiFi
object network Voice
subnet 192.168.20.0 255.255.255.0
description Voice
object-group protocol TCPUDP
protocol-object udp
protocol-object tcp
object-group service RDP tcp-udp
port-object eq 3389
object-group network Google_DNS_Group
network-object object Google_DNS_1
network-object object Google_DNS_2
object-group service DM_INLINE_TCP_20 tcp
port-object eq ftp
port-object eq ftp-data
object-group network DM_INLINE_NETWORK_2
object-group service DM_INLINE_SERVICE_12
service-object icmp
service-object tcp destination eq ftp
service-object tcp destination eq ftp-data
object-group protocol DM_INLINE_PROTOCOL_3
protocol-object ip
protocol-object icmp
object-group network PrivateNetworks
network-object 10.0.0.0 255.0.0.0
object-group network USG_Networks_To_Block
description Guest - Networks to block
network-object object company_Voice_Range
network-object object VPN_IP_Pool
network-object 10.15.3.0 255.255.255.0
network-object 10.15.4.0 255.255.255.0
network-object object HR_Dept
network-object object HR_Public_IP
network-object 10.0.0.0 255.0.0.0
network-object object company_Internal_Range
object-group service time-servers udp
port-object eq ntp
object-group network Nextiva_IP_Ranges
network-object object Nextiva_Block_1
group-object Google_DNS_Group
network-object object Nextiva_Block_2
object-group service DM_INLINE_TCP_1 tcp
port-object eq www
port-object eq https
object-group service DM_INLINE_SERVICE_1
service-object tcp-udp destination eq sip
service-object udp destination eq sip
object-group service DM_INLINE_SERVICE_2
service-object ip
service-object tcp
service-object object LWNAS_443
object-group service mDNS udp
description udp 5353
port-object eq 5353
object-group protocol DM_INLINE_PROTOCOL_1
protocol-object ip
protocol-object icmp
object-group protocol DM_INLINE_PROTOCOL_2
protocol-object ip
protocol-object icmp
object-group network Domain_Controllers
description ICT Domain Controllers
network-object object ICTDC01
network-object object ICTDC03
network-object object ICTDC06
object-group protocol DM_INLINE_PROTOCOL_4
protocol-object ip
protocol-object icmp
object-group service DM_INLINE_TCP_2 tcp
group-object RDP
port-object eq ftp
port-object eq www
port-object eq https
port-object eq ssh
object-group protocol DM_INLINE_PROTOCOL_5
protocol-object ip
protocol-object icmp
access-list inside_nat0_outbound extended permit ip any object VPN_IP_Pool
access-list outside_access_in extended deny udp any object DMZ_Radius eq 5353
access-list outside_access_in extended permit icmp any any
access-list outside_access_in extended permit icmp any 10.15.2.0 255.255.255.0
access-list outside_access_in extended permit object forecasttl any4 object ForecastTool
access-list outside_access_in extended permit ip any object LWNAS
access-list 110 extended permit ip 10.0.0.0 255.0.0.0 object VPN_IP_Pool
access-list inside_access_in_1 extended permit ip 10.15.2.0 255.255.255.0 any
access-list inside_access_in extended permit ip any any
access-list ASA-Sourcefire extended permit ip any any inactive
access-list company-VPN-Split-Tunnel standard permit 10.15.0.0 255.255.0.0
access-list voice_access_in extended deny ip object-group PrivateNetworks any
access-list voice_access_in extended permit tcp 192.168.20.0 255.255.255.0 object nextiva_background_images object-group DM_INLINE_TCP_1
access-list voice_access_in extended permit object-group DM_INLINE_SERVICE_1 192.168.20.0 255.255.255.0 any
access-list voice_access_in extended permit object-group DM_INLINE_PROTOCOL_2 192.168.20.0 255.255.255.0 object-group Nextiva_IP_Ranges
access-list voice_access_in extended permit udp any any eq ntp
access-list voice_access_in extended deny ip any any log debugging
access-list voice_access_in extended deny icmp any any inactive
access-list To_5516_access_in extended permit object-group DM_INLINE_PROTOCOL_4 any object-group Domain_Controllers
access-list To_5516_access_in extended permit object-group TCPUDP any object-group Domain_Controllers eq domain
access-list To_5516_access_in extended deny object-group DM_INLINE_PROTOCOL_5 any any
access-list To_5516_access_in extended deny tcp any any object-group DM_INLINE_TCP_2
access-list To_5516_access_in extended deny tcp any any eq lpd
access-list DMZ_access_in extended permit ip any any
access-list DMZ-2_access_in extended deny ip any any inactive
access-list AnyConnect_Client_Local_Print extended deny ip any4 any4
access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq lpd
access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol
access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 631
access-list AnyConnect_Client_Local_Print remark Windows' printing port
access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 9100
access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol
access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.251 eq 5353
access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol
access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.252 eq 5355
access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol
access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 137
access-list AnyConnect_Client_Local_Print extended permit udp any4 any4 eq netbios-ns
access-list from_outside extended permit icmp any any echo
access-list LW_WiFi_access_in extended deny ip any 192.168.20.0 255.255.255.0
access-list LW_WiFi_access_in extended deny ip any 10.15.4.0 255.255.255.0
access-list LW_WiFi_access_in extended permit ip any any
access-list HR_Dept_access_in extended deny ip any 192.168.100.0 255.255.255.0
access-list HR_Dept_access_in extended deny ip any 192.168.20.0 255.255.255.0
access-list HR_Dept_access_in extended deny ip any 10.15.3.0 255.255.255.0
access-list HR_Dept_access_in extended permit ip any any
access-list Printers_access_in extended permit object-group DM_INLINE_PROTOCOL_1 any any
!
tcp-map tmap
invalid-ack allow
seq-past-window allow
tcp-options md5 clear
!
pager lines 24
logging enable
logging timestamp
logging asdm-buffer-size 200
logging buffered debugging
logging trap warnings
logging asdm debugging
logging host inside 10.15.2.226
mtu outside 1500
mtu inside 1500
mtu voice 1500
mtu Printers 1500
mtu LW_WiFi 1500
mtu HR_Dept 1500
mtu To_5516 1500
no failover
no monitor-interface Printers
no monitor-interface HR_Dept
no monitor-interface service-module
icmp unreachable rate-limit 1 burst-size 1
icmp permit any outside
icmp permit any inside
asdm image disk0:/asdm-7121.bin
no asdm history enable
arp timeout 14400
arp permit-nonconnected
arp rate-limit 16384
nat (inside,outside) source static company_Internal_Range company_Internal_Range destination static NETWORK_OBJ_10.245.245.0_24 NETWORK_OBJ_10.245.245.0_24 no-proxy-arp route-lookup
nat (HR_Dept,outside) source static HR_Dept HR_Dept destination static NETWORK_OBJ_10.245.245.0_24 NETWORK_OBJ_10.245.245.0_24 no-proxy-arp route-lookup
!
object network obj_any
nat (inside,outside) dynamic interface
object network ForecastTool
nat (inside,outside) static ForecastTool-Ext
object network LWNAS
nat (inside,outside) static LWNAS-EXT service tcp 5001 https
object network HR_Nat
nat (any,any) static HR_Public_IP
object network Corp_WiFi
nat (any,any) static 75.75.75.67
object network Voice
nat (any,any) static Voice_NAT
!
nat (Printers,outside) after-auto source static Printers Printer-External-IP
access-group outside_access_in in interface outside
access-group inside_access_in_1 in interface inside control-plane
access-group inside_access_in in interface inside
access-group voice_access_in in interface voice
access-group Printers_access_in in interface Printers
access-group LW_WiFi_access_in in interface LW_WiFi
access-group HR_Dept_access_in in interface HR_Dept
access-group To_5516_access_in in interface To_5516
route outside 0.0.0.0 0.0.0.0 75.75.75.65 1
route To_5516 10.16.1.0 255.255.255.0 192.168.95.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:05:00 sip-invite 0:05:00 sip-disconnect 0:05:00
timeout sip-provisional-media 0:05:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10

I am trying to access the public IP 75.75.75.126 from the inside interface of the ASA. I also have devices in the same /26 as the ASA outside interface that I cannot get to.

On packet trace

Interface:inside 

Packet Type: IP

Source: IP Address: 10.15.2.50

Destination: IP Address: 75.75.75.126

I get green checks all the way until the last one 

Result - The packet is dropped

Inputer Interface: UNKNOWN

Output Interface: UNKNOWN

Info: (no-adjacency) No valid adjacency

thank you

[Francesco Molino]

Can you try this config please:

object network PUBLIC-IP
subnet 75.75.75.64 255.255.255.192
nat (inside,outside) source static company_Internal_Range company_Internal_Range destination static PUBLIC-IP PUBLIC-IP no-proxy-arp route-lookup

If not working, type the following command on ssh and share the output:
packet-tracer input inside udp 10.15.2.150 161 75.75.75.126 161 details