ASA firewall static PAT port range test

I. Testing the topology

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M00/73/38/wKioL1X38T-gdNFLAAB2SFv8Pow785.jpg "title=" top. JPG "alt=" Wkiol1x38t-gdnflaab2sfv8pow785.jpg "/>

Two. Test ideas

1. Test the continuous port Pat for TCP and UDP, respectively

2. Then use the static port conversion tool to convert the TCP port and UDP port to a common port for testing

---TCP conversion to TCP23, test with Telnet

---UDP conversion to UDP514, test with syslog send

3. For easy testing, the firewall only has two zones outside and inside

---Map the tcp1000~2000 of the inside server to the tcp1000~2000 of the firewall outside port

---Map the udp1000~2000 of the inside server to the upd2000~3000 of the firewall outside port

4. Test finds that if the TCP port range is the same as the UDP port range, the second NAT is not configured, and the following error is reported:

Error:nat Unable to reserve ports.

Three. Basic Configuration

1.Outside Server

Ip:202.100.1.8/24

2. Firewall ASA842

Interface GigabitEthernet0
Nameif Outside
Security-level 0
IP address 202.100.1.10 255.255.255.0
!
Interface GigabitEthernet1
Nameif Inside
Security-level 100
IP address 10.1.1.10 255.255.255.0

3.Intside Server

Ip:10.1.1.8/24

gw:10.1.1.10

Four. Static Pat Port range configuration

1. Defining a port Range object

Object Network Inside_server
Host 10.1.1.8

Object Service Tcp_ports
Service TCP Destination range 1000 2000

Object Service Udp_ports
Service UDP destination Range 2000 3000

2. Configure Twice-nat

Nat (Outside,inside) source static any any destination static interface Inside_server service Tcp_ports tcp_ports

Nat (Outside,inside) source static any any destination static interface Inside_server service Udp_ports udp_ports

3. Configure and apply a firewall policy

Access-list Outside Extended Permit TCP any object Inside_server range 1000 2000
Access-list Outside extended Permit UDP any object Inside_server range 2000 3000

Access-group Outside in Interface Outside

4. Test validation

---can be verified in a variety of ways, if the static port conversion is too cumbersome, can be directly caught packet verification

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M01/73/3B/wKiom1X371WjYC-zAAKKG3cPRyk111.jpg "title=" top. JPG "alt=" Wkiom1x371wjyc-zaakkg3cpryk111.jpg "/>

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M02/73/3B/wKiom1X375rBWB5FAAi4Hi0gI4M239.jpg "title=" top. JPG "alt=" Wkiom1x375rbwb5faai4hi0gi4m239.jpg "/>

This article is from the "Httpyuntianjxxll.spac.." Blog, make sure to keep this source http://333234.blog.51cto.com/323234/1695049

ASA firewall static PAT port range test