Monday, May 24, 2021

FW NAT rule confused...

My understanding is that on the ASA, the traditional way to do static manual NAT rules on ASA, is write the the in the order:

nat (src_int,dst_int) static [src] [src] [dst] [dst] service [port] [port] 

I just implemented a rule that wouldn't work in this order today. The rule I did is below

nat (INSIDE,OUTSIDE) source static SERVER interface destination static CLIENT CLIENT service port22 port2016 

The rule doesn't work. I tested a connection from the client to the server, and see the packet come in correct in a live capture, but not leave the ASA. Having read through the logs, you just get generic errors of: TCP request discarded.

In any event, I tried the rule the opposite way around and it works:

nat (OUTSIDE,INSIDE) source static CLIENT CLIENT destination static interface SERVER service port2016 port22 

Can't get my head around this. Aren't they the same thing? Note, for the sake of testing, I just put permit any any on all the interfaces, so that I know it couldn't be any ACLs.



No comments:

Post a Comment