ASA firewall static PAT port range test

Source: Internet
Author: User

I. Testing the topology

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M00/73/38/wKioL1X38T-gdNFLAAB2SFv8Pow785.jpg "title=" top. JPG "alt=" Wkiol1x38t-gdnflaab2sfv8pow785.jpg "/>

Two. Test ideas

1. Test the continuous port Pat for TCP and UDP, respectively

2. Then use the static port conversion tool to convert the TCP port and UDP port to a common port for testing

---TCP conversion to TCP23, test with Telnet

---UDP conversion to UDP514, test with syslog send

3. For easy testing, the firewall only has two zones outside and inside

---Map the tcp1000~2000 of the inside server to the tcp1000~2000 of the firewall outside port

---Map the udp1000~2000 of the inside server to the upd2000~3000 of the firewall outside port

4. Test finds that if the TCP port range is the same as the UDP port range, the second NAT is not configured, and the following error is reported:

Error:nat Unable to reserve ports.

Three. Basic Configuration

1.Outside Server

Ip:202.100.1.8/24

2. Firewall ASA842

Interface GigabitEthernet0
Nameif Outside
Security-level 0
IP address 202.100.1.10 255.255.255.0
!
Interface GigabitEthernet1
Nameif Inside
Security-level 100
IP address 10.1.1.10 255.255.255.0

3.Intside Server

Ip:10.1.1.8/24

gw:10.1.1.10


Four. Static Pat Port range configuration

1. Defining a port Range object

Object Network Inside_server
Host 10.1.1.8

Object Service Tcp_ports
Service TCP Destination range 1000 2000

Object Service Udp_ports
Service UDP destination Range 2000 3000

2. Configure Twice-nat

Nat (Outside,inside) source static any any destination static interface Inside_server service Tcp_ports tcp_ports

Nat (Outside,inside) source static any any destination static interface Inside_server service Udp_ports udp_ports

3. Configure and apply a firewall policy

Access-list Outside Extended Permit TCP any object Inside_server range 1000 2000
Access-list Outside extended Permit UDP any object Inside_server range 2000 3000

Access-group Outside in Interface Outside

4. Test validation

---can be verified in a variety of ways, if the static port conversion is too cumbersome, can be directly caught packet verification

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M01/73/3B/wKiom1X371WjYC-zAAKKG3cPRyk111.jpg "title=" top. JPG "alt=" Wkiom1x371wjyc-zaakkg3cpryk111.jpg "/>

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M02/73/3B/wKiom1X375rBWB5FAAi4Hi0gI4M239.jpg "title=" top. JPG "alt=" Wkiom1x375rbwb5faai4hi0gi4m239.jpg "/>

This article is from the "Httpyuntianjxxll.spac.." Blog, make sure to keep this source http://333234.blog.51cto.com/323234/1695049

ASA firewall static PAT port range test

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.