Looks like we got it!   I had to modify your latest changes a little bit:   From: nat (inside,outside) source static SERVER interface service CUSTOM81 CUSTOM80   To: nat (inside,outside) 1 source static SERVER interface service CUSTOM81 CUSTOM80   That combined with the ACLs worked! So to put it all in one place:   object network Utility1 host 10.1.1.79 ! access-list outside_access_in extended permit tcp any object Utility1 eq 81 ! nat (inside,outside) 1 source static Utility1 interface service CUSTOM81 CUSTOM80 ! access-group outside_access_in in interface outside   Thank you so much for your help!   ... View more

Hi - Unfortunately it still doesn't work. I've attached the latest packet tracer below. I also tried flipping the NAT policies like we talk about yesterday but no luck.   ciscoasa(config)# packet-tracer input outside tcp 8.8.8.8 81 96.89.224.197 80 Phase: 1 Type: ROUTE-LOOKUP Subtype: Resolve Egress Interface Result: ALLOW Config: Additional Information: found next-hop 96.89.224.197 using egress ifc identity Phase: 2 Type: NAT Subtype: per-session Result: ALLOW Config: Additional Information: Phase: 3 Type: ACCESS-LIST Subtype: Result: DROP Config: Implicit Rule Additional Information: Result: input-interface: outside     ciscoasa(config)# show nat Manual NAT Policies (Section 1) 1 (inside) to (outside) source static Utility1 interface service CUSTOM80 CUSTOM81 translate_hits = 0, untranslate_hits = 0 2 (wlan) to (outside) source dynamic obj_any interface translate_hits = 4143583, untranslate_hits = 365981 3 (inside) to (outside) source static any any destination static NETWORK_OBJ_10.1.2.0_26 NETWORK_OBJ_10.1.2.0_26 no-proxy-arp route-lookup translate_hits = 0, untranslate_hits = 0 Auto NAT Policies (Section 2) 1 (any) to (outside) source dynamic obj_any interface translate_hits = 48275, untranslate_hits = 3822 Manual NAT Policies (Section 3) 1 (inside) to (outside) source dynamic obj_any interface translate_hits = 0, untranslate_hits = 0     ... View more

Looks like it's still dropped by the ACL:   ciscoasa# packet-tracer input outside tcp 8.8.8.8 1234 96.89.224.197 80 Phase: 1 Type: ROUTE-LOOKUP Subtype: Resolve Egress Interface Result: ALLOW Config: Additional Information: found next-hop 96.89.224.197 using egress ifc identity Phase: 2 Type: NAT Subtype: per-session Result: ALLOW Config: Additional Information: Phase: 3 Type: ACCESS-LIST Subtype: Result: DROP Config: Implicit Rule Additional Information: Result: input-interface: outside input-status: up input-line-status: up output-interface: NP Identity Ifc Action: drop Drop-reason: (acl-drop) Flow is denied by configured rule ... View more

Hey - Yea, but I think that is https, not http. If I'm in a browser and go to https I'm able to login to AnyConnect. However, if I go on http port 80 I don't get AnyConnect or the website I'm expecting. I also don't get anything when I browse on http port 81. ... View more

See below:   ciscoasa(config)# packet-tracer input outside tcp 8.8.8.8 1234 96.89.224.197 80 Phase: 1 Type: ROUTE-LOOKUP Subtype: Resolve Egress Interface Result: ALLOW Config: Additional Information: found next-hop 96.89.224.197 using egress ifc identity Phase: 2 Type: NAT Subtype: per-session Result: ALLOW Config: Additional Information: Phase: 3 Type: ACCESS-LIST Subtype: Result: DROP Config: Implicit Rule Additional Information: Result: input-interface: outside input-status: up input-line-status: up output-interface: NP Identity Ifc Action: drop Drop-reason: (acl-drop) Flow is denied by configured rule ... View more

Hi - I appreciate the help. Unfortunately, this didn't seem to work either. Although, this time the packet-tracer hits the NAT and gets through it but is stopped by the ACL. I've also re-attached the config.   ciscoasa# packet-tracer input outside tcp 8.8.8.8 1234 96.89.224.197 81 Phase: 1 Type: ROUTE-LOOKUP Subtype: Resolve Egress Interface Result: ALLOW Config: Additional Information: found next-hop 96.89.224.197 using egress ifc identity Phase: 2 Type: NAT Subtype: per-session Result: ALLOW Config: Additional Information: Phase: 3 Type: ACCESS-LIST Subtype: Result: DROP Config: Implicit Rule Additional Information: Result: input-interface: outside input-status: up input-line-status: up output-interface: NP Identity Ifc Action: drop Drop-reason: (acl-drop) Flow is denied by configured rule ... View more

Unfortunately, neither of the new NAT rules worked using the after-auto or "1" command to specify the order. I still get the same results of a dropped packet via an implicit rule. I also don't see any hits on the NAT rule or ACL. It's my understanding that the ACL is processed before the NAT rule so I'm wondering if that's where the issue resides...there has to be something I'm missing though...   Updated NAT table and packet-tracer below:   ciscoasa# show nat Manual NAT Policies (Section 1) 1 (inside) to (outside) source static any any destination static NETWORK_OBJ_10.1.2.0_26 NETWORK_OBJ_10.1.2.0_26 no-proxy-arp route-lookup translate_hits = 818, untranslate_hits = 881 2 (wlan) to (outside) source dynamic obj_any interface translate_hits = 4103849, untranslate_hits = 314450 Auto NAT Policies (Section 2) 1 (inside) to (outside) source static Utility1 interface service tcp www 81 translate_hits = 0, untranslate_hits = 0 2 (any) to (outside) source dynamic obj_any interface translate_hits = 15919, untranslate_hits = 4 Manual NAT Policies (Section 3) 1 (inside) to (outside) source dynamic obj_any interface translate_hits = 0, untranslate_hits = 0       ciscoasa# packet-tracer input outside tcp 8.8.8.8 1234 10.1.1.79 81 Phase: 1 Type: ROUTE-LOOKUP Subtype: Resolve Egress Interface Result: ALLOW Config: Additional Information: found next-hop 10.1.1.79 using egress ifc inside Phase: 2 Type: ACCESS-LIST Subtype: Result: DROP Config: Implicit Rule Additional Information: Result: input-interface: outside input-status: up input-line-status: up output-interface: inside output-status: up output-line-status: up Action: drop Drop-reason: (acl-drop) Flow is denied by configured rule ... View more

Hey - Below is my show NAT and the packet tracer output. Thanks again for all of the help!   ciscoasa(config)# show nat Manual NAT Policies (Section 1) 1 (inside) to (outside) source static any any destination static NETWORK_OBJ_10.1.2.0_26 NETWORK_OBJ_10.1.2.0_26 no-proxy-arp route-lookup translate_hits = 818, untranslate_hits = 881 2 (inside) to (outside) source dynamic obj_any interface translate_hits = 292844, untranslate_hits = 14867 3 (wlan) to (outside) source dynamic obj_any interface translate_hits = 4092438, untranslate_hits = 308198 Auto NAT Policies (Section 2) 1 (inside) to (outside) source static Utility1 interface service tcp www 81 translate_hits = 0, untranslate_hits = 0 2 (any) to (outside) source dynamic obj_any interface translate_hits = 15869, untranslate_hits = 0   ciscoasa# packet-tracer input outside tcp 8.8.8.8 1234 10.1.1.79 81 Phase: 1 Type: ROUTE-LOOKUP Subtype: Resolve Egress Interface Result: ALLOW Config: Additional Information: found next-hop 10.1.1.79 using egress ifc inside Phase: 2 Type: ACCESS-LIST Subtype: Result: DROP Config: Implicit Rule Additional Information: Result: input-interface: outside input-status: up input-line-status: up output-interface: inside output-status: up output-line-status: up Action: drop Drop-reason: (acl-drop) Flow is denied by configured rule ciscoasa# ... View more

Hi - Unfortunately that didn't seem to make a difference. My packet-tracer still fails with an implicit rule drop.   Here are the snippets from my config:   object network Utility1 host 10.1.1.79 access-list outside_access_in extended permit tcp any object Utility1 eq www object network Utility1 nat (inside,outside) static interface service tcp www 81 access-group outside_access_in in interface outside   Thoughts? ... View more

So, unfortunately I'm having trouble with the NAT statement you suggested. I think via my Googling I've found that 8.3+ requires a new NAT format and syntax. Here is what I typed to try to get it as close to yours as possible:   nat (inside,outside) source static any interface service Port80 Port81   I had to create Service Objects as it wouldn't let me specify the port explicitly. I also had to add the source parameter before the word static.   Unfortunately, even with this command and the the access-list/access-group commands I still get dropped packets via an implicit rule.   Config snippets:   nat (inside,outside) source static any any destination static NETWORK_OBJ_10.1.2.0_26 NETWORK_OBJ_10.1.2.0_26 no-proxy-arp route-lookup nat (inside,outside) source dynamic obj_any interface nat (wlan,outside) source dynamic obj_any interface nat (inside,outside) source static any interface service Port80 Port81   object service Port80 service tcp source eq www destination eq www   object service Port81 service tcp destination eq 81   access-list outside_in extended permit tcp any host 10.1.1.79 eq www   access-group outside_access_out out interface outside access-group inside_access_in_1 in interface inside access-group inside_access_out_1 out interface inside access-group wlan_access_in_1 in interface wlan access-group wlan_access_out out interface wlan   I've attached the entire config file if that would be more helpful.   Thanks! ... View more