Static NAT ASA

looks fine Zeke, except maybe for

access-list access_interface_out extended permit tcp any4 object-group Nodes_In eq https

I have cleaned it up for you, there was a few duplicate ACL that were unnecessary.

object network OBJ_INTERNAL_192.168.1.9
host 192.168.1.9
!
object network OBJ_EXTERNAL_62.x.x.1
host 62.x.x.1
!
object-group network OBJG_Cloud_IPS_1
network-object host 22.x.x.x
network-object host 23.x.x.x
!
object-group network OBJG_Cloud_IPS_2
network-object host 24.x.x.x
network-object host 25.x.x.x
!
object-group service OBJG-SG_IN_TRAFFIC tcp
port-object eq https
port-object eq smtp
!
!
nat (inside,outside) 1 source static OBJ_INTERNAL_192.168.1.9 OBJ_EXTERNAL_62.x.x.1
!
!
access-list outside_access_in line 1 extended permit tcp object-group OBJG_Cloud_IPS_1 object OBJ_INTERNAL_192.168.1.9 object-group OBJG-SG_IN_TRAFFIC
access-list outside_access_in line 2 extended permit tcp object-group OBJG_Cloud_IPS_2 object OBJ_INTERNAL_192.168.1.9 object-group OBJG-SG_IN_TRAFFIC
!
access-group outside_access_in in interface outside

Select all Open in new window

object-group network OBJG_Cloud_IPS
 network-object host 22.x.x.x
 network-object host 23.x.x.x
 network-object host 24.x.x.x
 network-object host 25.x.x.x
!
access-list outside_access_in line 1 extended permit tcp object-group OBJG_Cloud_IPS object OBJ_INTERNAL_192.168.1.9 object-group OBJG-SG_IN_TRAFFIC

Select all Open in new window

Thank you very much.

And if i wanted all ports under "IN_TRAFFIC" group to be allowed for ObjInternal-192.168.1.9 can i do the following acl?

access-list access_interface_out extended permit tcp object ObjInternal-192.168.1.9 object-group IN_TRAFFIC

Yes, the server will need to be accessible from the outside via https.

object-group network OBJG_ALLOWED_FROM_OUTSIDE
 network-object host x.x.x.x
 network-object y.y.y.y.y m.m.m.m.m
!
object network ObjInternal-192.168.1.9
 host 192.168.1.9
!
object-group service IN_TRAFFIC tcp
port-object eq https
port-object eq smtp
!
access-list access_interface_out extended permit tcp object-group OBJG_ALLOWED_FROM_OUTSIDE object ObjInternal-192.168.1.9 object-group IN_TRAFFIC

Select all Open in new window

The object and object-groups can be discussed as:
The ACL is divided into 7 parts:

access-list access_interface_out extended permit tcp object-group OBJG_ALLOWED_FROM_OUTSIDE object ObjInternal-192.168.1.9 object-group IN_TRAFFIC

Select all Open in new window

Keeping those in mind, source IP/port and destination IP/port can be specific values, an object or an object-group. So in the end, the ACL can be a single line using objects and object-groups or individual lines using specific IP/port value. If planned and named properly, objects and object-groups can neat up the configuration for ease of tshooting or it can be a nightmare as reading each ACL line you'll have to reference the object/object-group configuration. Either way, it's up to the admin.

Hope this gives you a helpful insight, let me know if you have further questions and I'll be glad to help out.

Thanks. And if i wanted to for source ip...i could use "any" instead of creating a object group and adding ips, correct?

yes that its correct

So, I had issues with this change. It seems that as soon as I did the static NAT command, the internet access on the server would get shut down and i wasnt able to get to the outside. I added all ACLs afterwards as well but still had no luck. Any ideas?

Few things i can think of:
If you can provide a sanitized configuration I might be able to look into it:
You can also provide a packet-tracer output when the static NAT is in place. It would give us an idea where it is failing (ACL,NAT,route)

packet-tracer input inside in tcp INTERNAL_SERVER_IP 80 8.8.8.8 80

I'm not there now...will provide it asap. For the time being just to give u more details...

Yes, i did put "1".
The IP is not being used anywhere else.
It's part of the outside interface subnet.

I did packet tracer and everything was "allow" no drops. It even said allow translation from private to public.

Please note: Without the static nat rule, i can get out using the outside interface (dynamic nat).

Hmmm, if packet-tracer was fine. I'm assuming that there was no issue with the ACL or NAT.

How did you test the internet connectivity?

Hi Ffleisma,

Here is some more configuration from the firewall that might help resolve the issue:

- Please note that i did not include ACLs for the two translations that are in place since those have been there and working.  I am concerned with "objInternal-192.168.1.9 objExternal-62.x.x.3" as this is the one I am trying to add and still had no luck. I included the configuration that i put in for the project as well as a little bit of additional configuration that is currently in the firewall that I believe could show the potential issue.

Thank you so much.

xlate per-session deny tcp any4 any4
xlate per-session deny udp any4 any4

interface GigabitEthernet0/1
 nameif outside
 security-level 0
 ip address 62.x.x.1 255.255.255.192
!
interface GigabitEthernet0/2
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0

same-security-traffic permit inter-interface
same-security-traffic permit intra-interface

object network obj-192.168.1.0
 subnet 192.168.1.0 255.255.255.0

object network obj-192.168.0.0
 subnet 192.168.0.0 255.255.252.0

object network objInternal-192.168.1.9
host 192.168.1.9

object network objExternal-62.x.x.3
host 62.x.x.3

object network objOP-192.168.1.20
host 192.168.1.20

object network objOPS-192.168.1.21
host 192.168.1.21

object network objOP-62.x.x.20
host 62.x.x.20

object network objOPS-62.x.x.21
host 62.x.x.21

object network obj_ALL
 subnet 0.0.0.0 0.0.0.0

object-group network OBJG_Cloud_IPS_1
network-object host 22.x.x.x
network-object host 23.x.x.x

object-group network OBJG_Cloud_IPS_2
network-object host 24.x.x.x
network-object host 25.x.x.x

object-group service OBJG-SG_IN_TRAFFIC tcp
port-object eq https
port-object eq smtp

access-list NoNat extended permit ip 192.168.1.0 255.255.255.0 192.168.0.0 255.255.252.0
access-list access_interface_in extended permit icmp any4 any4
access-list access_interface_out extended permit icmp any4 any4
access-list inside_access_in line 1 extended permit any object objInternal-192.168.1.9 any
access-list outside_access_in line 1 extended permit tcp object-group OBJG_Cloud_IPS_1 object objInternal-192.168.1.9 object-group OBJG-SG_IN_TRAFFIC
access-list outside_access_in line 2 extended permit tcp object-group OBJG_Cloud_IPS_2 object objInternal-192.168.1.9 object-group OBJG-SG_IN_TRAFFIC

access-group inside_access_in in interface inside
access-group outside_access_in in interface outside

nat (inside,any) source static obj-192.168.1.0 obj-192.168.1.0 destination static
obj-192.168.0.0 obj-192.168.0.0 no-proxy-arp route-lookup

nat (inside,outside) 1 source static objInternal-192.168.1.9 objExternal-62.x.x.3
nat (inside,outside) source static objOP-192.168.1.20 objOP-62.x.x.20
nat (inside,outside) source static objOP-192.168.1.21 objOPS-62.x.x.21
!
object network obj_ALL
 nat (inside,outside) dynamic interface

route outside 0.0.0.0 0.0.0.0 62.x.x.1 1
timeout xlate 2:00:00
timeout pat-xlate 0:00:20

looking at the configuration you provided, the NAT should be fine, but I do see some error on the ACL, this might be a typo from your end.

access-list inside_access_in line 1 extended permit any object objInternal-192.168.1.9 any

Select all Open in new window

To allow PING specifically, you'll need to add the following:

access-list inside_access_in line 1 extended permit icmp object objInternal-192.168.1.9 any echo
!
access-list outside_access_in line 1 extended permit icmp any object objInternal-192.168.1.9 echo-reply

Select all Open in new window

Also you have other static NAT configurations for 192.168.1.20 & 192.168.1.21, you can reference the ACL for those and add similar ACL for 192.168.1.9.

Lastly, when the static NAT configuration is added:

Hello,

Thank you for your help and time ffleisma.

- I will be going over at the end of next week to give it another try. And i will try to do the telnet.
- It is using external DNS.

Do i need to do any clearing with xlate or conn?

Thank you so much.

Zeke

Additionally, in one of the above replies you mentioned the following:

"check DNS resolution, if you are using an external DNS, you'll need to allow the traffic from the server to external DNS. Also note that the public IP of the server is now changed at this point."

Having the following ACL in place, it would take care of that, too, correct?

access-list inside_access_in line 1 extended permit ip object objInternal-192.168.1.9 any

Thanks

Yup, the "allow ip" rule should be able to catch the DNS as well.

Since you mentioned that the packet tracer output was doing fine, I tend to suspect DNS. The packet-tracer output should be able to provide a clue to where it might be failing. Also you are right, clearing the xlate can help to ensure that NAT bindings are renewed.

If the packet-tracer went fine and you can do a telnet via port 80, then I think it would be less likely an issue with the firewall configuration. Hopefully you would be able to accomplish your project next time around.

Great solution that provided all details.