So this is what I currently have in the config.
object network LOCAL_LAN
subnet 192.168.0.0 255.255.255.0
object network SSLVPN_NETWORK
subnet 192.168.100.0 255.255.255.0
object network 70.102.23.162
host 70.102.23.162
object service http
service tcp source eq www destination eq www
object network WEB-SERVER
host 192.168.0.1
object network WEB-SERVER-TCP39214
host 192.168.0.1
object-group service HTTP
service-object tcp source eq www
object-group service SSH
description Remote server access
service-object tcp destination eq 39124
access-list inside_access_in remark Webserver
access-list inside_access_in extended permit udp any any eq www
access-list inside_access_in extended permit ip 192.168.100.0 255.255.255.0 192.168.0.0 255.255.255.0
access-list inside_access_in extended permit ip 192.168.0.0 255.255.255.0 192.168.100.0 255.255.255.0
access-list outside_access_in remark Webserver
access-list outside_access_in extended permit tcp any any eq www
access-list outside_access_in extended permit ip any any
access-list outside_access_in extended permit icmp any any echo
access-list outside_access_in extended permit icmp any any echo-reply
access-list outside_access_in extended permit tcp any object WEB-SERVER eq www
access-list outside_access_in remark WEB-SERVER
access-list outside_access_in extended permit udp any object WEB-SERVER eq www
access-list outside_access_in remark WEB-SERVER access
access-list outside_access_in extended permit tcp any object WEB-SERVER eq 39124
access-list NAT-EXEMPT extended permit ip 192.168.0.0 255.255.255.0 192.168.100.0 255.255.255.0
access-list SPLIT_TUNNEL standard permit 192.168.0.0 255.255.255.0
access-list SPLIT_TUNNEL standard permit 192.168.100.0 255.255.255.0
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
ip local pool SSLVPN 192.168.100.100-192.168.100.200 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
icmp permit any outside
no asdm history enable
arp timeout 14400
nat (inside,outside) source static LOCAL_LAN LOCAL_LAN destination static SSLVPN_NETWORK SSLVPN_NETWORK
nat (inside,outside) source static SSLVPN_NETWORK SSLVPN_NETWORK destination static LOCAL_LAN LOCAL_LAN
!
object network LOCAL_LAN
nat (inside,outside) dynamic interface
object network WEB-SERVER
nat (inside,outside) static interface service tcp www www
object network WEB-SERVER-TCP39214
nat (inside,outside) static interface service tcp 39124 39124
access-group outside_access_in in interface outside
You're saying I don't need the: no nat (inside,outside) source static SSLVPN_NETWORK SSLVPN_NETWORK destination static LOCAL_LAN LOCAL_LAN statment?
I thought I needed to add it for both directions. Is this not true?
(I also cleaned up the network objects as you can see and got rid of the "Server" one and just am using the "WEB_SERVER" one. Is this ok? Also both packet-tracer tests passed with port 80 and 39124.
CMNW# packet-tracer input outside tcp 1.1.1.1 12345 50.186.40.128 39124
Phase: 1
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
object network WEB-SERVER-TCP39214
nat (inside,outside) static interface service tcp 39124 39124
Additional Information:
NAT divert to egress interface inside
Untranslate 50.186.40.128/39124 to Server/39124
Phase: 2
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group outside_access_in in interface outside
access-list outside_access_in extended permit ip any any
Additional Information:
Phase: 3
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Phase: 4
Type: HOST-LIMIT
Subtype:
Result: ALLOW
Config:
Additional Information:
Phase: 5
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
object network WEB-SERVER-TCP39214
nat (inside,outside) static interface service tcp 39124 39124
Additional Information:
Phase: 6
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Phase: 7
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 1607, packet dispatched to next module
Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: inside
output-status: up
output-line-status: up
Action: allow
CMNW# packet-tracer input outside tcp 1.1.1.1 12345 50.186.40.128 80
Phase: 1
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
object network WEB-SERVER
nat (inside,outside) static interface service tcp www www
Additional Information:
NAT divert to egress interface inside
Untranslate 50.186.40.128/80 to Server/80
Phase: 2
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group outside_access_in in interface outside
access-list outside_access_in extended permit tcp any any eq www
Additional Information:
Phase: 3
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Phase: 4
Type: HOST-LIMIT
Subtype:
Result: ALLOW
Config:
Additional Information:
Phase: 5
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
object network WEB-SERVER
nat (inside,outside) static interface service tcp www www
Additional Information:
Phase: 6
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Phase: 7
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 1609, packet dispatched to next module
Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: inside
output-status: up
output-line-status: up
Action: allow
