Cisco ASA Static NAT Configuration

[lagapidis (Lazarus Agapidis)]

Hello Naila

Yes you are absolutely correct!

Laz

[a.amin (ankit a)]

Hello

nat (outside,inside_1) source static any any destination static interface inside-server service RDP-33320 RDP-3389 no-proxy-arp

Can you please explain this NAT rule?

I have already ask you guys below question in different forum. I don’t know where. It works through above NAT rule only.

We are configuring new ASA 5506 and this is our topology.
we are having some serious issue to access remote desktop from outside.

nat (any,outside) source dynamic any-inside-networks interface description Allow Inside to Ouside

we use above rule to allow internet from inside to outside and it works and It is at number 1 in NAT rules.

Now we have few server that we would like to access from outside so we were trying to open ports.
we create network object NAT rules and access-lists for that for some reason it didn’t work so we create manual NAT before network object NAT rules. It only works when It is at number 1. That’s fine but than our internet stops working.

So we don’t have any idea what we are doing wrong.

If some can help me ASAP because we are planning to deploy ASAP

[ReneMolenaar]

Hello Ankit,

If you run into issues with NAT or packet drops, check xlate and packet tracer first. Here’s an example where I use it for the config in this lesson:

Cisco ASA NAT Port Forwarding

Verify that my NAT rules are correct:

ASA1# show xlate
2 in use, 2 most used
Flags: D - DNS, e - extended, I - identity, i - dynamic, r - portmap,
       s - static, T - twice, N - net-to-net
TCP PAT from DMZ:192.168.3.1 80-80 to OUTSIDE:192.168.2.254 80-80
    flags sr idle 0:03:27 timeout 0:00:00
TCP PAT from DMZ:192.168.3.3 22-22 to OUTSIDE:192.168.2.254 10022-10022
    flags sr idle 0:00:03 timeout 0:00:00

Verify that I can connect. In my case, TCP 192.168.2.254:10022 translates to 192.168.3.3:22:

ASA1# packet-tracer input OUTSIDE tcp 192.168.2.2 12345 192.168.2.254 10022

Phase: 1
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
object network SSH_SERVER
 nat (DMZ,OUTSIDE) static interface service tcp ssh 10022 
Additional Information:
NAT divert to egress interface DMZ
Untranslate 192.168.2.254/10022 to 192.168.3.3/22

Phase: 2
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group DMZ_SERVERS in interface OUTSIDE
access-list DMZ_SERVERS extended permit tcp any host 192.168.3.3 eq ssh 
Additional Information:

Phase: 3
Type: NAT
Subtype: per-session
Result: ALLOW 
Config:
Additional Information:

Phase: 4
Type: IP-OPTIONS
Subtype: 
Result: ALLOW
Config:
Additional Information:

Phase: 5
Type: QOS
Subtype: 
Result: ALLOW
Config:
Additional Information:

Phase: 6
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
object network SSH_SERVER
 nat (DMZ,OUTSIDE) static interface service tcp ssh 10022 
Additional Information:

Phase: 7
Type: QOS
Subtype: 
Result: ALLOW
Config:
Additional Information:

Phase: 8
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 9
Type: IP-OPTIONS
Subtype: 
Result: ALLOW
Config:
Additional Information:

Phase: 10
Type: FLOW-CREATION
Subtype: 
Result: ALLOW
Config:
Additional Information:
New flow created with id 3, packet dispatched to next module

Result:
input-interface: OUTSIDE
input-status: up
input-line-status: up
output-interface: DMZ
output-status: up
output-line-status: up
Action: allow

If something gets natted when it shouldn’t, or doesn’t get natted when it should…it’ll show up. If an access-list drops something, it will show.

Let’s break down this line:

nat (outside,inside_1) source static any any destination static interface inside-server service RDP-33320 RDP-3389 no-proxy-arp

We translate traffic routed from the outside to the inside:

nat (outside,inside_1)

We do static nat (1:1):

source static

For any source:

any

For this mapped source:

any

For this destination:

destination static interface inside-server

Where inside-server is an object with probably the IP address of your server?

For real service:

service RDP-33320

That probably has TCP 33320

And mapped service:

RDP-3389

That probably has TCP 3389. You don’t want the ASA to respond to ARP requests for IP addresses that belong to the subnet of the interface:

no-proxy-arp

I tried a similar NAT rule like yours:

nat (OUTSIDE,DMZ) source static any any destination static interface TELNET_SERVER service TCP_10023 TCP_23

It installs two entries:

ASA1(config)# show xlate
2 in use, 2 most used
Flags: D - DNS, e - extended, I - identity, i - dynamic, r - portmap,
       s - static, T - twice, N - net-to-net
TCP PAT from OUTSIDE:0.0.0.0/0 0 to DMZ:0.0.0.0/0 0
    flags srIT idle 0:00:40 timeout 0:00:00
TCP PAT from DMZ:192.168.3.3 23-23 to OUTSIDE:192.168.2.254 10023-10023
    flags srT idle 0:00:40 timeout 0:00:00

If you look at the first line, you can see it adds an Identity NAT entry:

Identity NAT translates the real IP address to the same IP address. Only “translated” hosts can create NAT translations and responding traffic is allowed back.

This messes up your Internet access, it translates your private IP address to the same private IP addresses.

Your port translation partly works. When you connect to TCP 33320 then it gets translated to TCP 3389.

Also, make sure you have an access-list that permits the real port number. Not the translated one.

Your internet NAT line works:

nat (any,outside) source dynamic any-inside-networks interface description Allow Inside to Ouside

And shows up like this:

ASA1(config)# show xlate
3 in use, 4 most used
Flags: D - DNS, e - extended, I - identity, i - dynamic, r - portmap,
       s - static, T - twice, N - net-to-net
NAT from OUTSIDE:0.0.0.0/0 to any:0.0.0.0/0
    flags sIT idle 0:00:47 timeout 0:00:00

If you want to get port forwarding and Internet access working, I would remove both NAT entries and replace them with this:

object network inside-server
 nat (DMZ,OUTSIDE) static interface service tcp 3389 33320 
object network any-inside-networks
 nat (DMZ,OUTSIDE) dynamic interface

And an access-list that permits TCP 3389. That’s all you need.

Hope this helps!

Rene

[maanpego (Marco Antonio P)]

Hi Rene,

One question: I understand the NAT concept, I know what is static NAT, dynamic NAT and PAT; also, I know how to configure each type, but I cannot imagine why should I use static NAT. Can you give me a real example where we need a 1 by 1 translation with static NAT instead PAT ?Doesn’t matter if is a Firewall or router.

THanks in advance!

[lagapidis (Lazarus Agapidis)]

Hello Marco

1 to 1 static NAT can be useful if you have an internal server which is running many different services, and if this server is behind a NAT router. Imagine you have a server running a SIP server, web, email, FTP, and Video on Demand, and you want this server to be reachable from the Internet. With a 1 to 1 mapping you have no need of setting up multiple ports for each service. You can simply reach the server using a single public IP address, which maps to the particular internal private IP address.

This is especially useful for real time services such as voice and video. For example, for VoIP, SIP may use ports 5060 and 5061 but the voice packets themselves that use RTP can use ports ranging anywhere from 16384 to 32767. So it’s not useful create PAT translations for all of those ports. There are solutions to this problem to allow voice to function over a PAT translation using features such as Session Traversal Utilities for NAT (STUN), but these can often be complex and time consuming to configure and may require specialized NAT routers/firewalls.

Also, any changes made to such an internal server would require changes to be made to the NAT router to accommodate all of the new translations.

Now one could argue that you can just get a routable IP address and assign it to the internal server directly, but that may be too costly for some users who may simply want to run such a server behind an ADSL or Cable connection.

So 1 to 1 NAT vastly simplifies the provisioning of an Internet-accessible server behind a NAT router especially for real time services.

I hope this has been helpful!

Laz

[maanpego (Marco Antonio P)]

Hi, Laz!

It has been very helpful! thank you so much!

Regards.

[helen_power (helen p)]

Hi, Is it possible for you to talk about twice NAT?

Thank you,

[lagapidis (Lazarus Agapidis)]

Hello Helen

Yes, this is a topic that needs to be added to the list of ASA lessons. We were chatting about this a few days ago with @ReneMolenaar. It is in the works to have that for you soon.

Thanks you for mentioning it, as this is useful to improve the site and its content!

Laz

[helen_power (helen p)]

Thank you very much.

[brunoleandroferreira (Bruno F)]

ASA1(config)# object network WEB_SERVER
ASA1(config-network-object)# host 192.168.1.1
ASA1(config-network-object)# nat (DMZ,OUTSIDE) static 192.168.2.200

For the statement above when trying to replicate i have the following error:

ASA1(config-network-object)# nat (dmz,outside) static (public IP)
ERROR: Address (public IP) overlaps with outside interface address.
ERROR: NAT Policy is not downloaded

Any toughs on this?

[lagapidis (Lazarus Agapidis)]

Hello Bruno

Take a look at this post:

Cisco ASA Dynamic NAT with DMZ

Hello Bruno The object network PUBLIC_POOL command is used to define the range of outside IP addresses to be used for NAT. This doesn’t have to be the actual physical address on the outside interface, and actually must be a range of addresses since we are configuring dynamic NAT. Actually, the IP addresses specified here don’t even have to be in the same subnet as the address of the outside interface, as long as there is routing to the configured outside NAT interfaces to reach them. I’m n…

I hope this has been helpful!

Laz

[brunoleandroferreira (Bruno F)]

Thank you, much apreciated

[aneba (Ayong N)]

Hi Rene,
I configure static NAT exactly as you did but its not working. The only thing I added was define the security levels. DMZ- 50 and outside-0.

I also added: policy-map global_policy
class inspection_default. inspect icmp

But still no translation from outside to DMZ.

I am using ASA Version 9.1(5)16.

Is there any additional configuration that makes it work that you did not add in this particular lesson?

[lagapidis (Lazarus Agapidis)]

Hello Ayong

First of all, this configuration in the lesson is supported for all ASAs version 8.3 and later, including your version. Secondly, I suggest you initially follow the configuration of the lesson and ensure that it is working as is, before you make any other changes. Once you get it working, you can then tweak it as you like and experiment with changes.

Even so, with the information you have given, there doesn’t seem to be anything that immediately indicates that there is a problem with your config. I suggest you do some troubleshooting or start again with a clean config.

I hope this has been helpful!

Laz

[sabiramicse (Abirami Shanmugam)]

First we configure the pool with IP addresses. Our next step is to create a network object for the DMZ subnet and to enable NAT:

ASA1(config)# object network DMZ
ASA1(config-network-object)# subnet 192.168.1.0 255.255.255.0
ASA1(config-network-object)# nat (DMZ,OUTSIDE) static PUBLIC_POOL

Why is the static keyword given here instead of dynamic since the address will be taken from the pool dynamically right?

[lagapidis (Lazarus Agapidis)]

Hello Abirami

The dynamic keyword is typically used when you want to map multiple internal private IP addresses to a pool of public IP addresses dynamically. It’s not suitable for mapping one subnet to another, because dynamic NAT deals with individual hosts, not entire subnets.

I hope this has been helpful!

Laz

[atifberlas (Atif Masood)]

Hi, Does the Static NAT works only for directly connected devices?
I am able to NAT the switch connected directly to ASA Firewall however it doesn’t work for device hanging off from that switch. Am I doing something wrong?

Issue is Resolved now - The server had .201 (Switch IP) set as GW - Once I changed it to .203 (FW IP), it worked.

[lagapidis (Lazarus Agapidis)]

Hello Atif

Yes, it is possible to NAT all inside addresses regardless of whether or not they are directly connected to the edge device. You can learn more about this at this NetworkLessons note on the topic.

Thanks for updating us on your progress and sharing with us the problem as well as the solution you discovered yourself, it always adds to the value of the forum!

I hope this has been helpful!

Laz