Cisco Firewall :: ASA 8.3(2) / PAT Interface Address With Static NAT Port Translation?
Aug 22, 2011
I have an 8.3(2) ASA with a single outside IP. Dynamic PAT translates inside addresses to the outside interface address. I would like to use static NAT with port translation to access an inside syslog server. I got an error when I tried using the outside interface address. Can I use both dynamic PAT and Port Translation with the same outside address?This is what I would like to use but I receive an error saying there is an overlap using the outside interface address.(192.168.1.0 is my inside network. 10.10.1.10 is the outside interface IP.)
object network inside-net
subnet 192.168.1.0 255.255.255.0
nat (inside, outside) dynamic interface
object network SYSLOG_SERVER
host 192.168.1.50
nat (inside,outside) static 10.10.1.10 service tcp ssh ssh
View 6 Replies
ADVERTISEMENT
Mar 24, 2011
In my router I can set rule that all traffic incoming to router's extAddr:8888, is forwarded to my intAddr:8888. But I also need reverse rule that packets originating from intAddr:8888 are translated to extAddr:8888. Can I do that? What technique can I search on google to find more information, because it is not port forwarding. I would calll it reverse port forwarding or static port address translation, but I do not find anything useful in internet searching these keywords.
View 3 Replies
View Related
May 30, 2011
I'm trying to migrate from olda PIX to newest ASA 8.4.1. Everything seems to be good except the static NAT. [code]
The inside interface uses implicit rule. ( permit any less secure network )
Although te above config the ASA logs the following.
TCP access denied by ACL from 94.94.94.94/2003 to outside:86.101.228.221/80
The 86.101.228.221 our public Internet IP whic are used as outside IP also.
View 8 Replies
View Related
Oct 31, 2011
I am trying to correctly configure our ASA 5520 and our Mitel Border Gateway in our DMZ. In the documentation for the Mitel border gateway it wants me to set up 2 external IP's on my ASA one to allow 443 traffice into the MBG, and another for 443 traffic that needs to be forwarded to port 4443 for the MGB in the DMZ. My problem is I don't know how to do this. the MBG only has one IP, and I need to have 2 different URL's mapped to two different external IP's both externally using port 443, and one of them forwarding to 4443 on the DMZ interface.
View 10 Replies
View Related
May 10, 2012
customer has a server which located in inside interace. and an outside interface connected to ISPA. cu config a static nat map inside server address to ISPA address, one day customer install a new outside interface to ISPB, cu config new static nat ,map same server inside server address to ISPB address. the server will allways be vistited from outside interface and reply, custome want traffic coming from ISPA will return to ISPA, traffic coming from ISPB will return to ISPB. but i found it is difficult implement this on ASA5580. i want use route-map on static nat, but it will not satisfy customer's request.
View 3 Replies
View Related
Jul 13, 2011
i have a problem customer has a server which located in inside interace. and an outside interface connected to ISPA. cu config a static nat map inside server address to ISPA address one day customer install a new outside interface to ISPB, cu config new static nat ,map same server inside server address to ISPB address. the server will allways be vistited from outside interface and reply, custome want traffic coming from ISPA will return to ISPA, traffic coming from ISPB will return to ISPB. but i found it is difficult implement this on ASA5580. i want use route-map on static nat, but it will not satisfy customer's request.
View 6 Replies
View Related
Dec 20, 2012
Recently upgraded to an Asa 5512x from a pix 515e. I have an Ipswitch secure MoveIT server on the dmz1 interface that needs to be accessed from both the inside and outside interfaces. I have setup a static nat from the outside to the dmz1 and it works, I can also connect from the inside interface. Now I need the MoveIT server to access the DNS server and email server on the inside interface so it can send notifications. On the pix I just created a static from the inside to the dmz1 using its own IP address - static (inside,dmz1) 192.168.1.7 192.168.1.7 net mask 255.255.255.255. I would then add the access-list to allow. How would I set this up with the Asa 8.6 commands?
View 5 Replies
View Related
Aug 4, 2012
I have site to site vpn between cisco asa and cisco 2911 router.asa is static ip and cisco 2911 side is dynamic ip. my site to site vpn is working fine. I am just trying to make PAT over the vpn means i want forward one ip in my public pool to one of my local ip in the cisco 2911 side.
View 2 Replies
View Related
Dec 5, 2012
I have a server in a DMZ of my 8.4 ASA with nat:
object network FTP-SERVER
host 192.168.1.102
nat (dmz,outside) static interface tcp ftp ftp
And that's working well. However, I now need to translate the source address of connections from the outside to the FTP server as well. The aim is that the source address of packets when they reach the FTP server is an address on the DMZ subnet (as the default route for the FTP server now needs to be something else, not the ASA) as well as this outside-dmz NAT. I thought overloading the DMZ interface of the ASA? Or another IP in that range?
View 2 Replies
View Related
Jan 19, 2013
Is it possible to perform static Nat's through an internal network?I have a ASA 5510 with a public outside interface (let’s call it 68.68.68.1), and I have an inside private IP address (192.168.1.2/24). The inside IP address leads to a 4900m with that interface being configured with a 192.168.1.1 (no switching). On the 4900 M I have several VLANs one of them is an internal DMZ of sorts. (192.168.2.0/24). Within this DMZ network are several Web servers which need to be associated a public IP address (68.68.68.x).
Every time I configure a static Nat to associating a public IP address with an internal IP address within the DMZ, packet Tracer on the ASA informs me that the packet gets dropped at the static Nat and I cannot figure out why this is so.Safe it to say my question still stands is it possible to Nat (68.68.68.222 to and 92.168.2.60) given the configuration above, and how would I go about configuring in such the manner above so that I acn apply static nat through the 192.168.1.0 network to reach the 192.168.2.0 network.
View 11 Replies
View Related
Mar 1, 2012
I have some issues with Twin PAT on ASA (8.4.2), there is sth I dont udnerstand FTP server is on the inside and client is in outside.
I did sth like this
object network NATED-11
host 20.20.20.11
object network REAL-2
host 10.200.200.2
object service SRV-FTP
service tcp destination eq ftp
nat (outside,inside) source static any any destination static NATED-11 REAL-2 service SRV-FTP SRV-FTP so teoretically there should be a problem in NAT cause there is a second channel for data etc. BUT according to docs "For applications that require application inspection for secondary channels (for example, FTP and VoIP),the ASA automatically translates the secondary ports."
The problem is that it doesn't work at all and got the syslogs
Debug on ASA shows
ASA5510(config)# nat: untranslation - outside:20.20.20.11/21 to inside:10.200.200.2/21
nat: untranslation - outside:20.20.20.11/21 to inside:10.200.200.2/21
nat: untranslation - outside:20.20.20.11/21 to inside:10.200.200.2/21
nat: translation - outside:20.20.20.252/37924 failed - port is not found in xlate(0-0)
[code]....
To make it work I need to modify the nat rule to sth like this (translate source of client to inside inteface of ASA) nat (outside,inside) 1 source static any interface destination static NATED-11 REAL-2 service SRV-FTP SRV-FTP / why its not working in the first place? aaa I forgot to mention that both modes of FTP were tested (passive and active)
View 1 Replies
View Related
Mar 10, 2012
Trying to translate telnet for switches to the outside ip address at some random ports.
172.16.200.2:23 -> 10.199.199.2:2300
172.16.200.3:23 -> 10.199.199.2:2301
172.16.200.4:23 -> 10.199.199.2:2302
etc....
ASA 5510 running 8.4(3):
interface Ethernet0/0
nameif outside
security-level 0
ip address 10.199.199.2 255.255.255.248
interface Ethernet0/1.200
vlan 200
nameif inside
security-level 100
ip address 172.16.200.254 255.255.255.0
[code]....
I can not access the switch at 10.199.199.2:2301 . What am I doing wrong? Or should cleaning toilets be something I really should look at! Now if i run this NAT statment:
object network Switch_TN
nat (inside,outside) static 10.199.199.3 service tcp telnet 2301
I am able to access the switch at 10.199.199.3:2301
View 7 Replies
View Related
Mar 6, 2013
I have a server on the inside of my network (with a internet Routable IP). It has been requested to me that people from the internet access port 80, and that is translated at the firewall to port 7080. I have set up a temp Access rule to allow access to 7080 from the outside and it is accessable. I am not sure what I am doing wrong, but I am tion from 80 not able to get the translato 7080 to work.
View 1 Replies
View Related
Jan 27, 2013
After adding a NAT rule on Friday morning, I'm now getting a bunch of "portmap translation creation failed" messages from my ASA5520. (It's currently running 8.4(3).) The failure errors appear to have nothing to do with the change that was made. [code] I have very similar rules in place for other vendors to access other machines. The only difference between this new one and those old ones is the use of the objects in the rule instead of the direct IP addresses. This is also the first one that invovles a range instead of a specific address or network. [code]
View 4 Replies
View Related
Feb 7, 2012
configure my cisco 892 router want a static ip address assigned to the interface because and I have no more internet on the router because am working on my network academy for CCENT?
View 28 Replies
View Related
Dec 13, 2011
I am trying to assign static ip address on vlan 1 interface , the model no of switch is SG300 & the firmware version is 1.1.2.0 .But whenever I type the IP address & press enter , a question is popped up asking for confirmation (switch0d851f(config-if)#ip address 1.1.1.1 255.0.0.0.
Please ensure that the port through which the device is managed has the proper settings and is a member of the new management interface.Would you like to apply this new configuration? (Y/N)[N] N )
View 3 Replies
View Related
Nov 17, 2012
I have a couple a questions answers on which i cant google for a period. BTW maybe i simly use wrong aproach to choose keywords.
1) Is it possible to assign same ip address to the same client each time it authenticated, preferably without using DHCP? Im definely sure that it possible but cant find corresponded configuration examples (my device is Cisco 1921 with IOS 15.0.1).
2) Is it possible to assign dynamic crypto map to loopback interface (the purpose to make EASY VPN Server accessible through two interfaces - maybe you recommend other approach instead?) - as i move workingcrypto map from phy int to loopback - i cant connect with reason "Phace1 SA policy proposal not accepted"
View 3 Replies
View Related
Aug 15, 2012
I am having difficulty following the logic of the port-translation. Here is the configuration on a 5505 with 8.3,So I would have thought the outside access-list should reference the 'mapped' port but even with 3398 open I cannot remote desktop to the host. If I open 3389 then I can connect successfully.
View 12 Replies
View Related
Dec 6, 2010
I have a nat and vpn setup on my Cisco 2801 router.Everything is working as expected except the NAT. I have a single static nat translation but it only works for inbound and not outbound. Going outbound, it uses the default overload nat address of the outside interface. [code] I want to add another mailserver. But I fear if one mailserver were to get black-listed, they would both be reporting there ip address as the same address (the one on the ethernet interface) which would blacklist both mail servers.Again, inbound nat works ok, but outbound is just using the IP of the ethernet0/0 address.
View 2 Replies
View Related
Jul 19, 2011
I am trying to change a static nat entry from this:
ip nat inside source list 1 interface Dialer0 overloadip nat inside source static tcp 192.168.0.246 25 interface Dialer0 25ip nat inside source static tcp 192.168.0.246 80 interface Dialer0 80ip nat inside source static tcp 192.168.0.246 443 interface Dialer0 443
to
ip nat inside source list 1 interface Dialer0 overloadip nat inside source static tcp 192.168.0.247 25 interface Dialer0 25ip nat inside source static tcp 192.168.0.247 80 interface Dialer0 80ip nat inside source static tcp 192.168.0.247 443 interface Dialer0 443
I have tried various methods from exec mode clear ip nat translation *
no ip nat inside source static tcp 192.168.0.246 443 interface dialer0 443 But I am getting cisco2800(config)#%Static entry in use, cannot remove.
View 2 Replies
View Related
Mar 29, 2011
I have inherited an ASA 5520. In doing some auditing of the setup, I have noticed a Static Route that has the inside interface of the ASA as the Gateway IP. I am trying to understand the purpose of this route or why a route would be setup this way.
Example Static Route:
Inside 10.xx.31.0 255.255.255.0 10.xx.xx.10 (10.xx.xx.10 is the inside interface of ASA)
View 2 Replies
View Related
Jun 2, 2013
I'm receiving an error when trying to access a web server behind from one subinterface to another subinterface on an ASA access the public IP. I'm getting the following:
Global Static NAT Deny IP spoof from (61.X.X.X) to 201.X.X.X on interface Outside
Traffic dies at the firewall stating that the traffic is spoofed from the Global address (61.) to the static (201.) address. Both bound to the outside interface. When I create a static NAT on the firewall there is no problem; however when I'm patting against the firewall to the public IP I get the denies.
View 3 Replies
View Related
Sep 21, 2011
Is it possible to assign a static route to an interface and not globally on a ASA 5510 ver 8.3.
I have two links between my offices one for Data via a VPN and one for video traffic which is a secure connection with QOS end to end.
All interfaces are on the same security level of 100 except Outside which is 0.
Office 1 Interfaces ASA 5510
VLAN 1 vOffice1Data 10.40.1.0/24
VLAN 3 vOffice1Video 10.40.2.0/24
VLAN 5 vInterOffice 10.40.5.0/24 (QOS connection Between Offices)
[Code]....
At the moment if I try and access data from VLAN 1 to VLAN 4 it gets to the destination ok going through the static route and over the vInterOffice connection but the problem is VLAN 4 returning the traffic. This fails because there is no static route back to VLAN 1. If I create a static route from Office 2 to VLAN 1 then it will route all my data traffic over it as well.
View 2 Replies
View Related
Mar 30, 2011
We have several pairs of ASA5510s in failover A/P mode, some running 8.3(2) and others running 8.4(1).
e0/0 = outside
e0/1 = inside
m0/0 = management
The problem we're having is we can't get anything to route out of the management interface unless we put in a static route at least to the subnet level. For example, we want syslog traffic to exit out m0/0 to our syslog server 10.71.211.79. Our 'gateway of last resort' points to the next hop out e0/0, and a second static route with a higher metric and a more distinct network space is for m0/0 as in:
route outside 0.0.0.0 0.0.0.0 192.168.49.129 1route management 10.72.0.0 255.255.0.0 10.72.232.94 10
This doesn't work, and ASDM loggin gives this error: ".....Routing failed to locate next hop for udp from NP Identity Ifc:10.72.232.89/514 to management:10.72.211.79/514"
If I put in a more granular subnet route, or a host route of the syslog server it works, such as:
route management 10.72.211.0 255.255.255.0 10.72.232.94 10 <------------- this works
route management 10.72.211.79 255.255.255.255 10.72.232.94 10 <------------- this works too
Why won't a static route for 10.71.0.0 255.255.0.0 work in this case?
We are going to have numerous hosts access and be sent messages though the management interface of these ASAs, and it would be very burdonsome to have to add a host, or even a subnet, route for every one. I've removed all static routes and tried to rely on EIGRP, but that doesn't work. I also had to put 'passive-interface management' under the EIGRP for this to work.
Here is the pertinant ASA config concerning syslog, routing, and interfaces:
interface Ethernet0/0 nameif outside security-level 0 ip address 192.168.49.140 255.255.255.128 standby 192.168.49.141 !interface Ethernet0/1 nameif inside security-level 100 ip address xxx.xxx.xxx.xxx 255.255.255.128 standby
[Code].....
View 3 Replies
View Related
May 28, 2012
We have a Cisco ASA 5520 and in order to conserve public IP addresses and configuration (possibly) can we use the same public IP address for a static NAT with two different interfaces? Here is an example of what I'm refering too where 10.10.10.10 would be the same public IP address.
-static (inside,Outside) 10.10.10.10 access-list inside_nat_static_1
-static (production,Outside) 10.10.10.10 access-list production_nat_static_1
View 2 Replies
View Related
Feb 3, 2013
I have ASA 5505 with basic licence, v9.1, ASDM 7.1. I want to create the DMZ for a web server.
The interface 0 is for the outside network The interface 6 is for the DMZ All other interfaces are for the inside network
My ISP provided me with one public static IP address, one gateway address and a subnet mask 255.255.255.252
1/ I would like to ask which interface I should assign the public static IP address to. Should it be assigned to the outside interface 0, or should it be assigned to the DMZ interface 6, while outside interface would be configured to use DHCP?
I tried to assign the static IP address to the outside interface first, but then when I used ASDM the “Public Servers” feature to configure NAT, I get error message that the outside interface and the public address cannot have the same IP address.
2/ For the sake of peace of mind, I am thinking about using the second firewall, which would be used only for the inside network. Can I connect this second firewall to one of the inside interfaces of the 1st firewall,
View 4 Replies
View Related
Oct 16, 2011
I have a asa 5520 with an outside and backup interface. I am trying to configure two static nat statements from the inside to the outside and backup interface. Here is what I have configured so far.
object network obj-10.1.1.254
host 10.1.1.254
object network obj-10.1.1.254
nat (inside,outside) static 172.25.10.3
I want to also use nat (inside,backup) static 172.25.10.3
View 3 Replies
View Related
Mar 20, 2012
I just upgraded my firewall to ASA 5505. Now, my original static ip address cofiguration is gone. Apperantly, Cisco went away from static ip address to something like nat (inside,outside) dynamic interface. how to create a static ip address under version 8.4? By the way, I am sharing what my configuration used to look before upgrading.
!
hostname cisco-asa
domain-name default.domain.invalid
names
!
interface Vlan1
nameif inside
security-level 100
[code].....
View 7 Replies
View Related
Sep 15, 2011
Our proxy/anti-smap/IPS box called PROXY is behind our Cisco ASA firewall. The PROXY is set in transparent mode.The PROXY internal ip is 1.1.1.1 (internal ip)We have the MX record for mail.domain.com with public ip 9.2.7.5 (public ip as we entered with ISP public DNS)What happens now is that the emails that come through get "caught" by the PROXY and then we setup a thing whereby the emails are then forwarded from PROXY to our mail.domain.com server. Also, we made a static entry in PROXY whereby we can https to our email server for the outlook web access from outside of work therefore allowing for users to see the outlook web access web page.On the Cisco firewall, we put the static entry that 9.2.7.5 is mapped to 1.1.1.1 thus the mail server public ip is mapped to the PROXY.
Now, the box has this thing whereby it sends an email to all staff once a day telling them how many mails are legit, how many rejected and how many are spam - the spam emails are listed within the email and staff can at a click of a release button next to each spam email release a particular email from the PROXY box and make it to into their inbox. This works fine from the inside network, but I have issues from the outside due to the DNS and other things.I also put in the PROXY that any network can release spam and that our staff vlan can release emails. Also, on the inside of the firewall we did an access list that computers from staff vlan can access 1.1.1.1 on port 6552 (Which is the release spam port).Hence, we can release emails from internal network through the Microsoft Outlook.
On the outside network, we cannot release emails when using outlook web access.The host name for the PROXY release spam is proxy.domain.com so what we did also today is ask "ISP" to make an A record entry for another public ip which is 9.2.7.6 for proxy.domain.com.We meanwhile made an entry on the access list that comptuers from outside can access 9.2.7.6 on port 6552 (which is the release port).Now the only question is in regards to the static entries:
1. do we (and can we?) static map 9.2.7.6 to 1.1.1.1 through a port 3840 on the Cisco ASA (although we have already mapped 1.1.1.1 to 9.2.7.5 - I have a doubt here as this might mean we might not get emails? Or would we have to do the static again for this one specifcying the 9.2.7.5 as an smtp entry and the 9.2.7.6 as a release button?
2. have I made a mistake in general and should I have just told the ISP to make a CNAME entry for proxy.domain.com with the public ip 9.2.7.5 (which is the public ip for MX record?)?
View 9 Replies
View Related
Nov 20, 2011
I have a cisco router 3845 with Etherswitch modules and one Vlan configured "172.16.6/24", many switch ports are assigned to this vlan. i would like to translate one IP address 172.16.6.200 to a new one "172.25.42.10" but need to keep the other IPs from "172.16.6/24" without changes. below is the configuration of vlan interface and switch port. [code]
View 8 Replies
View Related
Oct 18, 2011
I have 5 static public IP addresses assigned by my ISP. I like to use one of these static public IP addresses to access one of my PCs in my office from the outside. So I like to configure something like:65.11.22.44 <-> 192.168.1.100.This translation is good for all protocols and all ports. Where I can configure this on the DIR655?
View 2 Replies
View Related
Nov 30, 2011
I have an ASA 5510 running version 7.0. I have a problem with an exchange server using a static map and its outbounc connectivity. It connects outbound through the global address even though inbound connectivity works fine through the static mapping. The recent changes are changing of the zero route through a different interface (there are to circuit connected to this ASA on different interfaces). So the idea was to get all workstations in the office using the global address and routing out through one circuit, and the servers connecting in/out through the other circuit. Shouldn't a static mapping ignore what the zero route is?
Here are what I believe to be the relevant configs.
interface Ethernet0/0
description New 6mb circuit
speed 100
[Code]....
So exchang2 server can be connected to from the outside properly via IP xxx.207.51.231/exchange2-outside, but all outbound connections from this server are going out via IP xxx.122.47.218/circuit-6mb as do all the workstations due to the global address statement.
View 2 Replies
View Related
Nov 22, 2012
We've got an application that is running on our LAN that is using IP addressing to connect to the server (they refused to use DNS).The server is now being moved to a VM which will be on a different subnet. The supplier is now concerned that there will be a big down time due to him having to reconfigure each device (about 100) with the new server IP. If the server was external I know I'd be able to do NAT on the FW to make this work but can it be done internally on my 6500s? I want to have the devices pointing at their hardcoded IP address off 1.1.1.10 and NAT the destination to the VMware servers IP 2.2.2.10? Is this possible using cisco NAT?
View 13 Replies
View Related