ASA Policy NAT Question
Bookmark this page:
 Yahoo!
 Google
 Windows Live
 del.icio.us
 digg
 Netscape
|
|
||||||||||||||||
|
Posted by K.J. 44 on September 14, 2006, 9:12 am
Please log in for more thread options I would like to first say thanks to all who have helped me with my ASA. It has been my first time working with one and it has been interesting learning it. For those of you helping me before, I have no idea why it wouldn't let anything through. I simply removed everything, and put it all back in one at a time, testing each time. Now it is working. There must be something I am missing but when I look at my old configs and my new configs, they look almost identical. It doesn't matter because it is working.... Now my current issue is this. I am trying to configure static policy nat to check an ACL to see if the information is coming from or destined to my server on port 25 so that mail traffic has a different public ip then everything else. My current PAT for everything else is working fine. Here is my acl and nat statement: access-list policy_PAT_SMTP permit tcp host 192.168.1.4 any eq 25 access-list policy_PAT_SMTP permit tcp host 192.168.1.4 eq 25 any static (inside,outside) PUBLIC.IP.2 access-list policy_PAT_SMTP Here is my normal PAT which works fine: (from sh nat command) match ip inside 192.168.0.0 255.255.0.0 outside any dynamic translation to pool 2 (PUBLIC.IP.1) There are no hits on the policy NAT. Does anybody see anything glaringly wrong? I have been trying to telnet in on port 25 to test my mail servers connectivity. Thanks. | ||||||||||||||||
|
Posted by K.J. 44 on September 14, 2006, 10:49 am
Please log in for more thread options instead of the policy NAT. THis is not good. Mail is going through but mail will not be able to come in like this. There has to be something wrong with the ACL. access-list policy_PAT_SMTP permit tcp host 192.168.1.4 any eq 25 -- A match if the source address is the server and destination address is anything using port 25 access-list policy_PAT_SMTP permit tcp host 192.168.1.4 eq 25 any -- A match if the source is the server on port 25 to anywhere Now, with the policy NAT, the reverse is true right? So the second rule can be read also as "A match if the source is anywhere and the destination is the server on port 25. " Would I need to create a second Policy NAT that had something like: access-list policy_outside_SMTP permit tcp any host PUBLIC.IP eq 25 static (outside,inside) PRIVATE.IP access-list policy_outside_SMTP thanks. K.J. 44 wrote: | ||||||||||||||||
|
Posted by K.J. 44 on September 14, 2006, 10:55 am
Please log in for more thread options okay well i cant even do the last command so someone please shed some
light for me. Thanks. K.J. 44 wrote: > When my server sends mail, it is getting translated with the PAT
> instead of the policy NAT. THis is not good. Mail is going through > but mail will not be able to come in like this. > > There has to be something wrong with the ACL. > > access-list policy_PAT_SMTP permit tcp host 192.168.1.4 any eq 25 > -- A match if the source address is the server and destination address > is anything using port 25 > > access-list policy_PAT_SMTP permit tcp host 192.168.1.4 eq 25 any > -- A match if the source is the server on port 25 to anywhere > > Now, with the policy NAT, the reverse is true right? So the second > rule can be read also as "A match if the source is anywhere and the > destination is the server on port 25. " > > Would I need to create a second Policy NAT that had something like: > > access-list policy_outside_SMTP permit tcp any host PUBLIC.IP eq 25 > static (outside,inside) PRIVATE.IP access-list policy_outside_SMTP > > thanks. > K.J. 44 wrote: > > Hi,
> > > > I would like to first say thanks to all who have helped me with my ASA. > > It has been my first time working with one and it has been interesting > > learning it. For those of you helping me before, I have no idea why it > > wouldn't let anything through. I simply removed everything, and put it > > all back in one at a time, testing each time. Now it is working. > > There must be something I am missing but when I look at my old configs > > and my new configs, they look almost identical. It doesn't matter > > because it is working.... > > > > Now my current issue is this. I am trying to configure static policy > > nat to check an ACL to see if the information is coming from or > > destined to my server on port 25 so that mail traffic has a different > > public ip then everything else. My current PAT for everything else is > > working fine. Here is my acl and nat statement: > > > > access-list policy_PAT_SMTP permit tcp host 192.168.1.4 any eq 25 > > access-list policy_PAT_SMTP permit tcp host 192.168.1.4 eq 25 any > > > > static (inside,outside) PUBLIC.IP.2 access-list policy_PAT_SMTP > > > > Here is my normal PAT which works fine: (from sh nat command) > > > > match ip inside 192.168.0.0 255.255.0.0 outside any dynamic translation > > to pool 2 (PUBLIC.IP.1) > > > > There are no hits on the policy NAT. Does anybody see anything > > glaringly wrong? I have been trying to telnet in on port 25 to test my > > mail servers connectivity. > > > > Thanks. | ||||||||||||||||
|
Posted by K.J. 44 on September 14, 2006, 11:30 am
Please log in for more thread options Okay, my last post before I wait for a response (I feel like I am
talking to myself :) ) What i want is to have JUST SMTP traffic from the server translated to the PUBLIC IP #2. All other traffic from everyone translated to PUBLIC IP #1. I thought I could do that with policy NAT. Thanks in advance. K.J. 44 wrote: > okay well i cant even do the last command so someone please shed some
> light for me. > > Thanks. > > K.J. 44 wrote: > > When my server sends mail, it is getting translated with the PAT
> > instead of the policy NAT. THis is not good. Mail is going through > > but mail will not be able to come in like this. > > > > There has to be something wrong with the ACL. > > > > access-list policy_PAT_SMTP permit tcp host 192.168.1.4 any eq 25 > > -- A match if the source address is the server and destination address > > is anything using port 25 > > > > access-list policy_PAT_SMTP permit tcp host 192.168.1.4 eq 25 any > > -- A match if the source is the server on port 25 to anywhere > > > > Now, with the policy NAT, the reverse is true right? So the second > > rule can be read also as "A match if the source is anywhere and the > > destination is the server on port 25. " > > > > Would I need to create a second Policy NAT that had something like: > > > > access-list policy_outside_SMTP permit tcp any host PUBLIC.IP eq 25 > > static (outside,inside) PRIVATE.IP access-list policy_outside_SMTP > > > > thanks. > > K.J. 44 wrote: > > > Hi,
> > > > > > I would like to first say thanks to all who have helped me with my ASA. > > > It has been my first time working with one and it has been interesting > > > learning it. For those of you helping me before, I have no idea why it > > > wouldn't let anything through. I simply removed everything, and put it > > > all back in one at a time, testing each time. Now it is working. > > > There must be something I am missing but when I look at my old configs > > > and my new configs, they look almost identical. It doesn't matter > > > because it is working.... > > > > > > Now my current issue is this. I am trying to configure static policy > > > nat to check an ACL to see if the information is coming from or > > > destined to my server on port 25 so that mail traffic has a different > > > public ip then everything else. My current PAT for everything else is > > > working fine. Here is my acl and nat statement: > > > > > > access-list policy_PAT_SMTP permit tcp host 192.168.1.4 any eq 25 > > > access-list policy_PAT_SMTP permit tcp host 192.168.1.4 eq 25 any > > > > > > static (inside,outside) PUBLIC.IP.2 access-list policy_PAT_SMTP > > > > > > Here is my normal PAT which works fine: (from sh nat command) > > > > > > match ip inside 192.168.0.0 255.255.0.0 outside any dynamic translation > > > to pool 2 (PUBLIC.IP.1) > > > > > > There are no hits on the policy NAT. Does anybody see anything > > > glaringly wrong? I have been trying to telnet in on port 25 to test my > > > mail servers connectivity. > > > > > > Thanks. | ||||||||||||||||
|
Posted by englishoaks on September 15, 2006, 4:32 am
Please log in for more thread options I've done something like this with Pix6.3, might help you...?
I needed to policy nat traffic to a certain destination (down a vpn as it happens).... so I did it like this... translating to 192.168.228.0, and then setting my vpn trigger acl to pickup the 228.0 traffic, as opposed to the 1.0 traffic which was nat'ed like normal access-list policynat permit ip 192.168.1.0 255.255.255.0 host x.x.x.x static (inside,outside) 192.168.228.0 access-list policynat 0 0 let me know how you go? Matt K.J. 44 wrote: > Okay, my last post before I wait for a response (I feel like I am
> talking to myself :) ) > > What i want is to have JUST SMTP traffic from the server translated to > the PUBLIC IP #2. All other traffic from everyone translated to PUBLIC > IP #1. I thought I could do that with policy NAT. > > Thanks in advance. | ||||||||||||||||
| Similar Threads | Posted |
| ASA Policy NAT Question | September 14, 2006, 9:12 am |
| Question about NAT (maybe need to use policy NAT)? | June 30, 2008, 6:09 pm |
| policy route-map question | January 11, 2007, 10:54 am |
| Policy Based Routing Question | November 13, 2005, 7:38 pm |
| Policy Routing: Guaranteeing Bandwidth Question | March 27, 2007, 11:23 pm |
| policy based routing for multiple tracking options question | April 9, 2006, 8:42 pm |
| route-map question (how to policy route for all destinations except few subnets?) | August 13, 2005, 2:05 am |
| PIX Policy-NAT | October 17, 2005, 10:50 am |
| Policy NAT | October 15, 2007, 9:06 am |
| GRE & Policy Routing | July 28, 2005, 8:46 am |
| Service Policy | October 13, 2005, 7:41 am |
| ASA Policy NAT not working at all... | September 14, 2006, 11:58 am |
| Traffic policy. | October 2, 2006, 9:04 am |
| Cisco 877 - Policy Map | December 11, 2006, 1:59 pm |
| IOS Upgrading "Policy" | November 20, 2007, 9:33 pm |
>
> I would like to first say thanks to all who have helped me with my ASA.
> It has been my first time working with one and it has been interesting
> learning it. For those of you helping me before, I have no idea why it
> wouldn't let anything through. I simply removed everything, and put it
> all back in one at a time, testing each time. Now it is working.
> There must be something I am missing but when I look at my old configs
> and my new configs, they look almost identical. It doesn't matter
> because it is working....
>
> Now my current issue is this. I am trying to configure static policy
> nat to check an ACL to see if the information is coming from or
> destined to my server on port 25 so that mail traffic has a different
> public ip then everything else. My current PAT for everything else is
> working fine. Here is my acl and nat statement:
>
> access-list policy_PAT_SMTP permit tcp host 192.168.1.4 any eq 25
> access-list policy_PAT_SMTP permit tcp host 192.168.1.4 eq 25 any
>
> static (inside,outside) PUBLIC.IP.2 access-list policy_PAT_SMTP
>
> Here is my normal PAT which works fine: (from sh nat command)
>
> match ip inside 192.168.0.0 255.255.0.0 outside any dynamic translation
> to pool 2 (PUBLIC.IP.1)
>
> There are no hits on the policy NAT. Does anybody see anything
> glaringly wrong? I have been trying to telnet in on port 25 to test my
> mail servers connectivity.
>
> Thanks.