port forwarding through IPsec tunnel

[smstoyanov]

Here is my config for the IPsec connection.

tunnel-group XX.XX.XX.XX type ipsec-l2l
tunnel-group XX.XX.XX.XX general-attributes
default-group-policy IPSEC_IKEV1_Filters
tunnel-group XX.XX.XX.XX ipsec-attributes
ikev1 pre-shared-key *****

access-list 110 extended permit ip object NAT_10.10.10.10_32 object-group remote_hosts

crypto map ISP_2 152 match address 110
crypto map ISP_2 152 set peer XX.XX.XX.XX
crypto map ISP_2 152 set ikev1 transform-set ESP-AES256-SHA
crypto map ISP_2 152 set security-association lifetime seconds 3600

crypto map ISP_2 interface outside2

nat (inside,outside2) source dynamic MYLOCAL_NET  NAT_10.10.10.10_32 destination static remote_hosts remote_hosts
 

Here everything works fine!!!

I`m wondering how can apply port forwarding rule on Cisco ASA 5515 9.8 only available for IPsec.

In other words, when remote_host send requests to 10.10.10.10/32 i want these request to be forwarded to some internal IP-for example 192.168.0.2/32

[Bogdan Nita · Accepted solution]

Should be something like this:

nat (outside2,inside) 1 source static remote_hosts remote_hosts destination static NAT_10.10.10.10_32 NAT_192.168.0.2_32

it is basically a destination nat, you just need to make sure it's above your existing nat rule.

HTH

Bogdan

[smstoyanov]

Hello Bogdan,

thanks for the fast reply but i think that it will not work because ASA uses opposite direction related to nat rules.

For example, you can nat :

inside to outside

outside to outside

but outside to inside is not the relevant answer.

Could you tell me is it used in production on your side.

[Bogdan Nita]

Hi smstoyanov,

Not sure what you mean by "ASA uses opposite direction related to nat rules".

You can definitely nat packets coming from the outside interface and going to the inside interface.

I have definitely used nat config for that case, but do not think I used it combined with vpn.

If you do not want to apply it in production , which is the sensible thing to do, you can quickly test the config in a gns3 lab.

[smstoyanov]

Thanks Bogdan,

it works perfectly .