Cisco Firewall :: ASA Twice NAT (port Translation) - 8.4 In Depth?

Mar 1, 2012

I have some issues with Twin  PAT on ASA (8.4.2), there is sth I dont udnerstand FTP server is on the inside and client is in outside.
 
I did sth like this

object network NATED-11
host 20.20.20.11
object network REAL-2
host 10.200.200.2
object service SRV-FTP
service tcp destination eq ftp

nat (outside,inside) source static any any destination static NATED-11 REAL-2 service SRV-FTP SRV-FTP so teoretically there should be a problem in NAT cause there is a second channel for data etc. BUT according to docs "For applications that require application inspection for secondary channels (for example, FTP and VoIP),the ASA automatically translates the secondary ports."
 
The problem is that it doesn't work at all and got the syslogs

Debug on ASA shows
 
ASA5510(config)# nat: untranslation - outside:20.20.20.11/21 to inside:10.200.200.2/21
nat: untranslation - outside:20.20.20.11/21 to inside:10.200.200.2/21
nat: untranslation - outside:20.20.20.11/21 to inside:10.200.200.2/21
nat: translation - outside:20.20.20.252/37924 failed - port is not found in xlate(0-0)

[code]....
 
To make it work I need to modify the nat rule to sth like this (translate source of client to inside inteface of ASA) nat (outside,inside) 1 source static any interface destination static NATED-11 REAL-2 service SRV-FTP SRV-FTP / why its not working in the first place? aaa I forgot to mention that both modes of FTP were tested (passive and active)

View 1 Replies


ADVERTISEMENT

Cisco Firewall :: ASA 8.4.1 Static NAT With Port Translation

May 30, 2011

I'm trying to migrate from olda PIX to newest ASA 8.4.1. Everything seems to be good except the static NAT. [code]

The inside interface uses implicit rule. ( permit any less secure network )
 
Although te above config the ASA logs the following.
 
TCP access denied by ACL from 94.94.94.94/2003 to outside:86.101.228.221/80
 
The 86.101.228.221 our public Internet IP whic are used as outside IP also.

View 8 Replies View Related

Cisco Firewall :: ASA 5510 / Nat With Port Translation With 8.4(3)?

Mar 10, 2012

Trying to translate telnet for switches to the outside ip address at some random ports. 
 
172.16.200.2:23 ->  10.199.199.2:2300
172.16.200.3:23 ->  10.199.199.2:2301
172.16.200.4:23 ->  10.199.199.2:2302
etc....  
 
ASA 5510 running 8.4(3):
 
interface Ethernet0/0
nameif outside
security-level 0
ip address 10.199.199.2 255.255.255.248
 interface Ethernet0/1.200
vlan 200
nameif inside
security-level 100
ip address 172.16.200.254 255.255.255.0

[code]....
 
I can not access the switch at 10.199.199.2:2301 .  What am I doing wrong?  Or should cleaning toilets be something I really should look at!  Now if i run this NAT statment:
 
object network Switch_TN
nat (inside,outside) static 10.199.199.3 service tcp telnet 2301
 
I am able to access the switch at 10.199.199.3:2301

View 7 Replies View Related

Cisco Firewall :: Way To Be Able To Get / Port The Translation From 7080 To Work

Mar 6, 2013

I have a server on the inside of my network (with a internet Routable IP).  It has been requested to me that people from the internet access port 80, and that is translated at the firewall to port 7080.  I have set up a temp Access rule to allow access to 7080 from the outside and it is accessable.  I am not sure what I am doing wrong, but I am tion from 80 not able to get the translato 7080 to work. 

View 1 Replies View Related

Cisco Firewall :: ASA 5520 Address Translation And Port Forwarding

Oct 31, 2011

I am trying to correctly configure our ASA 5520 and our Mitel Border Gateway in our DMZ.  In the documentation for the Mitel border gateway it wants me to set up 2 external IP's on my ASA one to allow 443 traffice into the MBG, and another for 443 traffic that needs to be forwarded to port 4443 for the MGB in the DMZ.  My problem is I don't know how to do this. the MBG only has one IP, and I need to have 2 different URL's mapped to two different external IP's both externally using port 443, and one of them forwarding to 4443 on the DMZ interface.

View 10 Replies View Related

Cisco Firewall :: ASA5520 Port Map Translation Creation Failed

Jan 27, 2013

After adding a NAT rule on Friday morning, I'm now getting a bunch of "portmap translation creation failed" messages from my ASA5520.  (It's currently running 8.4(3).)  The failure errors appear to have nothing to do with the change that was made.  [code] I have very similar rules in place for other vendors to access other machines.  The only difference between this new one and those old ones is the use of the objects in the rule instead of the direct IP addresses.  This is also the first one that invovles a range instead of a specific address or network. [code]

View 4 Replies View Related

Cisco Firewall :: ASA 8.3(2) / PAT Interface Address With Static NAT Port Translation?

Aug 22, 2011

I have an 8.3(2) ASA with a single outside IP.  Dynamic PAT translates inside addresses to the outside interface address.  I would like to use static NAT with port translation to access an inside syslog server.  I got an error when I tried using the outside interface address.  Can I use both dynamic PAT and Port Translation with the same outside address?This is what I would like to use but I receive an error saying there is an overlap using the outside interface address.(192.168.1.0 is my inside network.  10.10.1.10 is the outside interface IP.)
 
object network inside-net
  subnet 192.168.1.0 255.255.255.0
  nat (inside, outside) dynamic interface
 object network SYSLOG_SERVER
  host 192.168.1.50
  nat (inside,outside) static 10.10.1.10 service tcp ssh ssh

View 6 Replies View Related

Cisco VPN :: 2911 / Port Address Translation For Remote Network?

Aug 4, 2012

I have site to site vpn between cisco asa and cisco 2911 router.asa is static ip and cisco 2911 side is dynamic ip. my site to site vpn is working fine. I am just trying to make PAT over the vpn means i want forward one ip in my public pool to one of my local ip in the cisco 2911 side.

View 2 Replies View Related

Cisco Routers :: Linksys RV082 VPN Router Port Translation

Feb 29, 2012

We have a RV082 Router and we are trying to do port translation.
 
For example:
88.123.2.5:80>192.168.1.10:2334
88.123.2.5:81>192.168.1.10:2335
 
However this does not seem to be possible as I can only choose the source port and the destination IP address unlike the RVS4000.

View 1 Replies View Related

Home Network :: Static Port Address Translation?

Mar 24, 2011

In my router I can set rule that all traffic incoming to router's extAddr:8888, is forwarded to my intAddr:8888. But I also need reverse rule that packets originating from intAddr:8888 are translated to extAddr:8888. Can I do that? What technique can I search on google to find more information, because it is not port forwarding. I would calll it reverse port forwarding or static port address translation, but I do not find anything useful in internet searching these keywords.

View 3 Replies View Related

Cisco Firewall :: ASA 5520 Nat Translation Max?

Aug 24, 2012

I am going with ASA 5520, know how many NAT translation is possible.

View 2 Replies View Related

Cisco Firewall :: ASA 8.4 With NAT Source Address Translation?

Dec 5, 2012

I have a server in a DMZ of my 8.4 ASA with nat:
 
object network FTP-SERVER
host 192.168.1.102
nat (dmz,outside) static interface tcp ftp ftp
 
And that's working well. However, I now need to translate the source address of connections from the outside to the FTP server as well. The aim is that the source address of packets when they reach the FTP server is an address on the DMZ subnet (as the default route for the FTP server now needs to be something else, not the ASA) as well as this outside-dmz NAT. I thought overloading the DMZ interface of the ASA? Or another IP in that range?

View 2 Replies View Related

Cisco Firewall :: ASA 5510 Dynamic NAT Inbound Translation

Jun 1, 2011

I have ASA 5510 and public FTP server from my local network to external IP address, with static nat translation. All works, but I need request to ftp come from internal ASA interface (need use gateway different ASA). How configured ASA for forwarding request?

View 4 Replies View Related

Cisco Firewall :: PIX515E - No Translation Group Found For TCP

Mar 17, 2012

i wounder why i'm getting such log message whenever i'm trying to reach my remote site: No translation group found for tcp src outside XXXX dst dmz ZZZZ, i have a Cisco PIX515E firewall and that message is captured there, the traffic is going through a VPN tunnel (the VPN are up on both ends)

View 2 Replies View Related

Cisco Firewall :: 5512x - Static Translation From DMZ To Inside On ASA 8.6

Dec 20, 2012

Recently upgraded to an Asa 5512x from a pix 515e. I have an Ipswitch secure MoveIT server on the dmz1 interface that needs to be accessed from both the inside and outside interfaces. I have setup a static nat from the outside to the dmz1 and it works, I can also connect from the inside interface. Now I need the MoveIT server to access the DNS server and email server on the inside interface so it can send notifications. On the pix I just created a static from the inside to the dmz1 using its own IP address - static (inside,dmz1) 192.168.1.7 192.168.1.7 net mask 255.255.255.255. I would then add the access-list to allow. How would I set this up with the Asa 8.6 commands?

View 5 Replies View Related

Cisco Firewall :: ASA 5510 - NAT Regular Translation Creation

Dec 4, 2012

I am having an issue with a specific server that is not reachable from other sub nets. Every other device on the same sub net as the server is reachable via the other sub nets. This server is special because it's NAT'd to an external IP address and has several site-to-site VPN's set up. The firewall is a Cisco ASA 5510.
 
This is the error I see on the ASA syslog when I try to ping the server from another sub net: 3 Dec 05 2012 10:58:49  10.0.15.101 regular translation creation failed for icmp src inside:10.0.20.8 dst inside:10.0.15.101 (type 0, code 0)          
 
The problem server is on sub net 10.0.20.0/24 and the server IP address is 10.0.20.8. Every device on the 10.0.20.0/24 sub net can hit the server, but devices on other sub nets cannot. For instance, a device on 10.0.15.0/24 cannot reach 10.0.20.8, but can reach other devices on 10.0.20.0/24.

View 1 Replies View Related

Cisco Firewall :: Error 305005 - No Translation Group Found?

Jun 26, 2011

Error message
305005: No translation group found for udp src c_dmz:10.0.176.120/51910 dst inside:195.244.192.16/53
305005: No translation group found for udp src c_dmz:10.0.176.120/51910 dst inside:195.244.192.166/53

[Code]....
 
I thought it needed a nat (c_dmz) command but I got the following error message
 
PIX(config)# nat (c_dmz) 0 0.0.0.0 0.0.0.0 0 0 nat 0 0.0.0.0 will be identity translated for outbound WARNING:  Binding inside nat statement to outermost interface. WARNING:  Keyword "outside" is probably missing.

View 2 Replies View Related

Cisco Firewall :: ASA 5510 Address Translation Through Internal Network

Jan 19, 2013

Is it possible to perform static Nat's through an internal network?I have a ASA 5510 with a public outside interface (let’s call it 68.68.68.1), and I have an inside private IP address (192.168.1.2/24). The inside IP address leads to a 4900m with that interface being configured with a 192.168.1.1 (no switching). On the 4900 M I have several VLANs one of them is an internal DMZ of sorts. (192.168.2.0/24). Within this DMZ network are several Web servers which need to be associated a public IP address (68.68.68.x).

Every time I configure a static Nat to associating a public IP address with an internal IP address within the DMZ, packet Tracer on the ASA informs me that the packet gets dropped at the static Nat and I cannot figure out why this is so.Safe it to say my question still stands is it possible to Nat (68.68.68.222 to and 92.168.2.60) given the configuration above, and how would I go about configuring in such the manner above so that I acn apply static nat through the 192.168.1.0 network to reach the 192.168.2.0 network.

View 11 Replies View Related

Cisco Firewall :: Cat 4500 Translation Creation Failed Message

Aug 1, 2012

Two Vlans (ID1 and 100)are on a Cat 4500, which connects to an ASA, interface DMZ. On 4500, there is default route point to the ASA DMZ interface Issue, server on vlan 100 cannot ping a server on Vlan 1, vice verse. When I enable the realtime log, it gives me a “Translation creation failed” message, please see the attached files.

View 1 Replies View Related

Cisco Firewall :: 5510 No Translation Group Found Error

May 31, 2011

I have a 5510 with just a inside and outside interface, everything works on the lan inc internet access and exchange hosting to the net, but I have another exchange server on the wan and I can't get to that because I'm not natting inbound traffic and the default route sends traffic elsewhere.
 
If I put a nat any statement on the inside interface inbound it works, however all LAN internet traffic fails with a  No translation group found error.I've removed the static nat commands as they are all named anyway, but below is what I have before I do a nat any inside inbound command global (outside) 1 interfaceglobal (inside) 2 interfacenat (inside) 0 access-list inside_nat0_outboundnat (inside) 1 0.0.0.0 0.0.0.0.

View 3 Replies View Related

Cisco Firewall :: DNS ASA5510 - Portmap Translation Creation Failed For Udp

May 22, 2012

See the error below on my ASA5510.
 
305006 200.200.0.34 53 portmap translation creation failed for udp src inside:192.168.1.4/1047 dst outside:200.200.0.34/53
 
The first two computers work normally( IP 2 and 3) , but the third computer gets ip does not work on the Internet.

View 2 Replies View Related

Cisco Firewall :: 5510 - No Translation Group Found For UDP Src Inside

Jan 10, 2013

I have seen many of these errors lately.  We have just moved to a new office and I have basically only assigned a new IP to the outside interface.
 
[code]....

View 6 Replies View Related

Cisco Firewall :: ASA 5505 - Regular Translation Creation Failed For Protocol 47 SRC

Oct 10, 2011

We have a PIX with 3 interfaces. Inside, Outside,DMZ.
 
On my DMZ we have some clients that come in and remotely connect back to there office via MSPPTP. I setup the ASA with this to get rid of the error message: regular translation creation failed for protocol 47 src
   
policy-map global-policy
inspection_default
inspect pptp
 
Now when the dmz client tries to connect back to there PPTP server I get the following error.
 
172.31.10.204 0 24.172.85.162 37624 Teardown dynamic GRE translation from dmz:172.31.10.204/0 to outside:24.172.85.162/37624 duration 0:01:30
172.31.10.204 1069 173.188.74.155 1723 Deny TCP (no connection) from 172.31.10.204/1069 to 173.188.74.155/1723 flags PSH ACK  on interface dmz
172.31.10.204  173.188.74.155 63767 Teardown GRE connection 8393958 from dmz:172.31.10.204 to outside:173.188.74.155/63767 duration 0:01:08 bytes [ code]...

View 7 Replies View Related

Cisco Firewall :: ASA 5540 - Portmap Translation Creation Failed For Tcp Src Inside

Mar 24, 2013

We have an ASA 5540 with 8.2(5)
 
Last three days in early afternoon we start getting these errors in the log and webpages either won't load or pages only half load.
 
3|Mar 22 2013|13:22:24|305006|184.73.105.115|443|||portmap translation creation failed for tcp src inside:10.10.176.114/58217 dst outside:184.73.105.115/443
3|Mar 22 2013|13:22:24|305006|54.243.129.71|80|||portmap translation creation failed for tcp src inside:10.35.54.37/1517 dst outside:54.243.129.71/80

[Code].....

View 6 Replies View Related

Cisco Firewall :: 5505 Static Nat With Port Redirection 8.3 Access List Using Un-Nat Port

Aug 15, 2012

I am having difficulty following the logic of the port-translation. Here is the configuration on a 5505 with 8.3,So I would have thought the outside access-list should reference the 'mapped' port but even with 3398 open I cannot remote desktop to the host. If I open 3389 then I can connect successfully.

View 12 Replies View Related

Cisco Firewall :: Change Default SSH Port On ASA 5505 (port Forwarding)

Dec 2, 2011

So here is my network.
 
ASA5505--->Cisco1841--->Cat2960
Code
ASA asa831-k8.bin
Cisco 1841 c1841-adventerprisek9-mz.151-4.M2.bin
Cat 2960 c2960-lanbasek9-mz.122-55.SE1.bin
 
and here is my dilemma.
 
I can SSH from the internet to my ASA on default port 22, directly to my public IP.  I can SSH from the internet to my Cisco 1841 on port 2001. I can not however, SSH to my Cat 2960.  From what i can tell, on the Cat2960 i can't change the default port 22 for SSH to different port, just like i did on the Cisco 1841.  I looked to see if I can change the default port for SSH on he ASA, it does not look like this is an option.
 
The bottom line is that i want to be able to SSH to all three devices from the internet.  I only have one public IP.  As of now, what i can do is only SSH to the ASA on default port 22 directly to the public IP and Cisco 1841 on port 2001.  It appears that changing the default SSH port on Cat 2960 is not an option.  It also appears that I can't change the default SSH port on the ASA, if i could, i would and then i should be able to SSH to the Cat 2960 on port 22. No matter what i did on the ASA, it always listens on port 22 for SSH connections.
 
show asp table socket
TCP       001f549f  <<pub IP>>:22              0.0.0.0:*               LISTEN
 
how do i make it listen on different port?
 
Here is relevent config for SSH for cisco 1841 (port forwarding)
 
ON ASA
object network ROUTER
host 10.10.1.1

[Code].....

View 28 Replies View Related

Cisco Firewall :: ASA 5520 - Moving Inside Port To 1gb SFP Port

Jun 11, 2012

We have an ASA 5520 and it's inside interface is currently plugged into a fast ethernet port on a 3750.  I have just bought a 1gig SFP module and have copied the fast ethernet port config to the gigabit port, but the port seems to be flapping
 
The port conf gi is this:
 
interface GigabitEthernet1/0/4
description Link to Inside ASA
switchport access vlan 2
switchport trunk encapsulation dot1q

View 1 Replies View Related

Cisco Firewall :: How To Forward Hit Request On 5555 Port To 80 Port

Nov 7, 2011

I have one server 172.16.0.100 and i nat this server to a public ip X.X.X.5 and i open RDP for this public ip.Now when i access Remote desktop on this public ip x.x.x.5 it open perfectly.Now my senario is that i want to open a http url on port 5555,server ADMIN open port 80 for this URL on LOCAL lan(http://172.16.0.100:80)So how can i map port 5555 to port 80 on ASA 5520.so when i hit URL [URL]

View 5 Replies View Related

Cisco Firewall :: 5520 - Use Management Port As Normal Port On ASA

Jan 2, 2012

I have got ASA 5520. How to use the management port as a normal port on ASA. What are the basic reqirements for that.

View 3 Replies View Related

Cisco Firewall :: ASA 8.4 / Translate Port 80 From Outside Connection On Port 85 In LAN Server?

Dec 27, 2011

i must translate port 80 from outside connection on port 85 in lan server? how can i configure the asa firewall rules for complete this task?

View 4 Replies View Related

Cisco Firewall :: ASA 5505 / Port 5901 - Alternate Port?

Aug 18, 2011

With the Cisco ASA-5505, is there a more secure port that can be configured for VNC other than 5901? I am new to Firewalls We have a User who has requested that 5901 be opened but I was advised not to do so for security concerns.

View 5 Replies View Related

Cisco WAN :: 881 Router - NAT Outside Translation

Jun 16, 2011

currently I face problem with outside nat translation and Im not sure how to solve it. I gotta 881 router
 
int vlan1
ip address 10.10.10.1 255.255.255.0
ip nat inside
[code]...
 
and remote server 100.100.100.25 routed to interface fa0/0. So the problem is that hosts from V lan 1 and V lan 2 want to communicate to this server, but they cannot route, which means, that I have to "give" them some IP from their range as fake address of this server and translate it. So I did
 
ip nat outside source static 100.100.100.25 10.10.10.7 (for Vlan 1)
ip nat outside source static 100.100.100.25 20.20.20.7 (for Vlan 2)
 
but I get
 
% 100.100.100.25 already mapped (10.10.10.7 -> 100.100.100.25)
 
As far as I understand router doesn't allow this translation, because if the communication would be started from outside (initial packet would come from server side), router wouldn't know how to translate its source address.

View 2 Replies View Related

Cisco VPN :: ASA 7.2(2) - No Translation Group Found?

Aug 1, 2010

My remote VPN clients aren't able to do anything network wise once they have connected to the VPN.  The ASA keeps coming up with "no translation group found" in the log. 

Result of the command: "show running"
 
: Saved:ASA Version 7.2(2) !hostname ciscoasadomain-name office.propertyfinder.comenable password ######## encryptednamesdns-guard!interface GigabitEthernet0/0 description Office Network Interface nameif Office-LAN security-level 100 ip address 10.121.10.4 255.255.255.0 ospf cost 10!interface GigabitEthernet0/1 description 4Mbps BTNet Internet Connection nameif Internet-Primary security-level 0 ip address 213.121.253.33 255.255.255.248 ospf cost 10!interface GigabitEthernet0/2 shutdown no nameif no security-level no ip address!interface GigabitEthernet0/3 description Office Wireless Interface nameif Office-Wireless security-level 10 ip address 172.16.0.1 255.255.255.0 ospf cost 10!interface Management0/0 nameif management security-level 100 ip address 192.168.1.1 255.255.255.0 ospf cost 10 management-only!passwd 2KFQnbNIdI.2KYOU encryptedboot system disk0:/asa722-k8.binftp mode passivedns domain-lookup Office-LANdns server-group DefaultDNS name-server 10.121.10.20 name-server 10.121.10.21 domain-name

[code]....

View 13 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved