?
Solved

Simple ASA 5510 NAT Question

Posted on 2012-08-14
5
Medium Priority
?
628 Views
Last Modified: 2013-01-15
Right now we have an internal server that is accessed through a Proxy Server.

The proxy server has 2 network cards.  1 of them has an external IP address of 12.xxx.xxx.xxx that we own and is attached directly to our outside switch.  The other network card has an internal address of 150.50.1.82 and it forwards traffic requests from the outside world onto another server with an address of 150.50.1.80.  This connection uses Port 443 (HTTPS)

We are looking to remove this proxy server from the setup and just utilize NAT with our ASA 5510 firewall instead.

So I did the following

---Create Static Nat Rule

object network obj-150.50.1.80
  nat (INSIDE, OUTSIDE) static 12.xxx.xxx.xxx

---Create ACL Rules

access-list INSIDE_access_out extended permit tcp host 12.xxx.xxx.xxx any eq https
access-list OUTSIDE_access_in extended permit tcp any host 150.50.1.80 eq https

I assumed that this would take care of so I unplugged the ethernet cable from the outside switch coming from the proxy server and waited for the traffic to start switching over to the ASA but this never happened.  I waited for about an hour and it never started working so I eventually had to the plug the proxy back in.

Is there something else that I am missing here?  I thought that was all that was needed.
0
Comment
Question by:gedruspax
  • 3
5 Comments
 
LVL 13

Expert Comment

by:xDUCKx
ID: 38293845
Where are you defining where the ACL's are applied?  Normally it's something like:

nat(inside,outside) static 12.xxx.xxx.xxx INSIDE_Access_out <Access-List2 Access-List3 etc>

Open in new window

0
 

Author Comment

by:gedruspax
ID: 38293869
After my NAT statements in the config I have

access-group INSIDE_access_out in interface INSIDE_INF
access-group INSIDE_INF_access_out out interface INSIDE_INF
access-group OUTSIDE_access_in in interface OUTSIDE
access-group OUTSIDE_access_out out interface OUTSIDE

is that was you are talking about?

Keep in mind this is ASA 8.4 with the revised NAT syntax
0
 

Author Comment

by:gedruspax
ID: 38293904
Also I have some other NAT rules in place that are working.

I have one for example that translates a public IP to the internal IP of our exchange server so we can use the front end for Ipads and Iphones.  And it is setup the same way and working.

object network obj-150.50.1.18
 nat (INSIDE,OUTSIDE) static 12.xxx.xxx.xxx

access-list DMZ_access_in extended permit tcp any host 150.50.1.18 eq https
access-list DMZ_access_in extended permit tcp any host 150.50.1.18 eq smtp
access-list DMZ_access_in extended permit tcp any host 150.50.1.18 eq pop3
access-list DMZ_access_in extended permit tcp any host 150.50.1.18 eq http
0
 
LVL 18

Accepted Solution

by:
fgasimzade earned 2000 total points
ID: 38294969
access-list INSIDE_access_out extended permit tcp host 12.xxx.xxx.xxx any eq https

change it to

access-list INSIDE_access_out extended permit tcp host 150.50.1.80  any eq https
0
 

Author Comment

by:gedruspax
ID: 38330144
I will try changing the access rule and see if that works.
0

Featured Post

The IT Degree for Career Advancement

Earn your B.S. in Network Operations and Security and become a network and IT security expert. This WGU degree program curriculum was designed with tech-savvy, self-motivated students in mind – allowing you to use your technical expertise, to address real-world business problems.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

You deserve ‘straight talk’ from your cloud provider about your risk, your costs, security, uptime and the processes that are in place to protect your mission-critical applications.
This article will show how Aten was able to supply easy management and control for Artear's video walls and wide range display configurations of their newsroom.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Suggested Courses

840 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question