Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

static nat with port redirection 8.3 access-list using un-nat port?

I am having difficulty following the logic of the port-translation and hoping someone can shed some light on it. Here is the configuration on a 5505 with 8.3

**************************************

object network obj-10.1.1.5-06

nat (inside,outside) static interface service tcp 3389 3398

object network obj-10.1.1.5-06

host 10.1.1.5

access-list outside_access_in line 1 extended permit tcp any any eq 3389 (hitcnt=3)

access-group outside_access_in in interface outside

***************************************

So I would have thought the outside access-list should reference the 'mapped' port but even with 3398 open I cannot remote desktop to the host. If I open 3389 then I can connect successfully. What gives?

Thanks in advance..

Everyone's tags (5)
3 REPLIES

static nat with port redirection 8.3 access-list using un-nat po

Hello,

I would be more than glad to explain you what is going on!

The thing is since 8.3 NAT is reviewed before the acl so, the ASA receives the packet on the outside interface, checks for a existing connection, if there is none it will un-nat the packet and then check the ACL.

After the packet in un-natted what we have is the private ip addresses and the real ports. so that is why on this versions you got to point the ACL to the private ip addresses and ports.

Regards,

Julio

Rate helpful posts

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC
Community Member

static nat with port redirection 8.3 access-list using un-nat po

This was not the behavior in 8.2 and previous correct? it would be great if there was a packet flow order of operation including nat for before 8.2 and after.

static nat with port redirection 8.3 access-list using un-nat po

Hello,

Correct,on 8.2 is different.

The best think I can provide you is this link, it will explain all the differences on 8.3.

https://supportforums.cisco.com/docs/DOC-12690

Regards,

Julio

Do rate helpful posts

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC
825
Views
0
Helpful
3
Replies
CreatePlease to create content