Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

ASA policy PAT and src/dst port considerations!!

static (inside,outside) tcp 4.2.2.2 443 10.1.2.3 443 netmask 255.255.255.255

What happens/is translated when a packet comes from the Internet destined for 4.2.2.2 with ..........

A:Src tcp port 1025 and dst tcp port 443

B: Src tcp port 443 and dst tcp port 1025

and, in the reverse direction from 10.1.2.3 back towards the internet

A:Src tcp port 1025 and dst tcp port 443

B: Src tcp port 443 and dst tcp port 1025

Or; does

static (inside,outside) tcp 4.2.2.2 443 10.1.2.3 443 netmask 255.255.255.255 only affect packets with dst tcp port 443

Or, my real question - will this policy NAT handle two way comms and in the manner TCP should work?

  • Firewalling
Everyone's tags (1)
1 REPLY

ASA policy PAT and src/dst port considerations!!

What happens/is translated when a packet comes from the Internet destined for 4.2.2.2 with ..........

A) the packet will be redirected to 10.1.2.3 on port 443

B) The packet will be drop by the ASA as there is no port-forwarding for port 1025 ( just for 443)

and, in the reverse direction from 10.1.2.3 back towards the internet

A) Packet from  a higher security level to a higher is going to be allowed by default if you have the right translation

B) The ASA will have already a entry on all of its table for this connection ( xlate,local-host and conn Table) so the traffic will be allowed without any inspection.

static (inside,outside) tcp 4.2.2.2 443 10.1.2.3 443 netmask 255.255.255.255 only affect packets with dst tcp port 443

Port-Forwarding is only for inbound connections, the outgoin packet for the same connection will hit this nat but if you start a new brand connection ( outbound) you will need a different nat

Regards,

Julio

Rate all the helpful posts

Looking for some Networking Assistance? Contact me directly at jcarvaja@laguiadelnetworking.com I will fix your problem ASAP. Cheers, Julio Carvajal Segura http://laguiadelnetworking.com
219
Views
0
Helpful
1
Replies