Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Cisco ASA 8.3(2) PAT issue

Hello

I have tried to solve it my self, but no luck.

I have this setup:

ISP modem (no NAT) - Cisco ASA 5505 firewall/router (NAT enabled, 1 external IP address) - local network.

I need to forward upto 5 ports to inside nework (192.168.1.0/24). Inside computers have Internet access, just PAT does not work.

As I am more ASDM user then commanline, but I can handel commandline too if needed (for PAT setup I have tried both)

I have created new NAT rules based on information what I have found in the Internet and Cisco website.

I have created following conf lines:

object network 192.168.1.102
host 192.168.1.102
object network KASSA
host 192.168.1.100

object network 192.168.1.102
nat (inside,outside) static interface service tcp 1205 1205
object network KASSA
nat (inside,outside) static interface service tcp 3389 3389

object-group icmp-type DM_INLINE_ICMP_1
icmp-object echo
icmp-object echo-reply
icmp-object time-exceeded
access-list outside_access_in_1 remark PING from outside.
access-list outside_access_in_1 extended permit icmp any interface outside object-group DM_INLINE_ICMP_1
access-list outside_access_in_1 extended permit tcp any object KASSA eq 3389
access-list outside_access_in extended permit tcp any object KASSA eq 3389

access-group outside_access_in_1 in interface outside

Ping from Outside is working as it should! But when I try to access to object KASSA to port 3389 is see this

7Oct 18 201020:34:10my other office IP54938outside IP3389TCP request discarded from my office IP/54938 to outside:outside IP/3389


Can someone help me to fix it. I have other ASA 5505/5510 devices too, but this device is only one running lates firmware.

Everyone's tags (3)
1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: Cisco ASA 8.3(2) PAT issue

Hello Tarmo

I hope you are doing great. I can see the port forwardings (Static PAT)  that you are doing, however, I cannot see the PAT configuraton. Make sure that the PAT configuration has the after-auto keyword, otherwise the PAT wont work.

Here is how it should look like

object network 192.168.1.102
host 192.168.1.102
object network KASSA
host 192.168.1.100

object network 192.168.1.102
nat (inside,outside) static interface service tcp 1205 1205
object network KASSA
nat (inside,outside) static interface service tcp 3389 3389

On global configuration mode

nat (inside,outside) after auto source dynamic any interface

Let me know if that works.

Mike

Mike
4 REPLIES
Cisco Employee

Re: Cisco ASA 8.3(2) PAT issue

tcp 3389 breaks? I used it exactly as you have configured. Config looks correct.

does tcp 1205 work?

what does packet tracer output show?

packet input outside tcp x.x.x.x 1025 o.o.o.o 3389 det

x.x.x.x - client ip that you are trying RDC from

o.o.o.o - outside IP address of the ASA.

-KS

Cisco Employee

Re: Cisco ASA 8.3(2) PAT issue

Hello Tarmo

I hope you are doing great. I can see the port forwardings (Static PAT)  that you are doing, however, I cannot see the PAT configuraton. Make sure that the PAT configuration has the after-auto keyword, otherwise the PAT wont work.

Here is how it should look like

object network 192.168.1.102
host 192.168.1.102
object network KASSA
host 192.168.1.100

object network 192.168.1.102
nat (inside,outside) static interface service tcp 1205 1205
object network KASSA
nat (inside,outside) static interface service tcp 3389 3389

On global configuration mode

nat (inside,outside) after auto source dynamic any interface

Let me know if that works.

Mike

Mike
New Member

Re: Cisco ASA 8.3(2) PAT issue

Hello Mike

thank you. Now 3389 port is working.

nat (inside,outside) after-auto source dynamic any interface - I had there nat (inside,outside) source dynamic any interface (default rule).

I will test with other ports too.

Greetings from Estonia.

Tarmo

Cisco Employee

Re: Cisco ASA 8.3(2) PAT issue

Hello Tarmo


Thank you a lot, I am glad I was able to help,

Greetings from Costa Rica !!

Mike

Mike
1640
Views
0
Helpful
4
Replies
CreatePlease to create content