![ASA 5510 8.4 Nat 和端口转发](https://linux22.com/image/802100/ASA%205510%208.4%20Nat%20%E5%92%8C%E7%AB%AF%E5%8F%A3%E8%BD%AC%E5%8F%91.png)
因此,我尝试将内部服务器上的内部服务转发到我们 ASA 外部接口上同一端口的外部接口。
我好几天都在寻找解决方案,但一无所获。
以下是我的配置的相关部分:
: Saved
:
ASA Version 8.4(2)
!
object service TCP-WebServer-8080
service tcp source eq 8080
object network WebServer_Object_10.1.10.7
host 10.1.10.7
object network obj-10.1.100.0
subnet 10.1.10.0 255.255.255.0
!
access-list outsidein extended permit ip object-group OUTSIDE object-group INSIDE
access-list insideout extended permit ip object-group INSIDE object-group OUTSIDE
access-list webserveraccess extended permit tcp any object WebServer_Object_10.1.10.7 eq 8080
!
nat (inside,outside) source dynamic obj-10.1.10.0 interface
!
access-group webserveraccess in interface outside
access-group insideout in interface inside
!
object network WebServer_Object_10.1.10.7
nat (inside,outside) static interface service tcp 8080 8080
以下是数据包跟踪器的输出:
Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 1.2.3.4 255.255.255.255 identity
Phase: 2
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: NP Identity Ifc
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule
因此,它看起来像是被 ACL 删除了,但在我看来是正确的。能否指导我做错了什么?
答案1
问题是我的(动态 PAT)覆盖了我的静态 PAT(端口转发)配置
nat (内部,外部) 源动态 obj-10.1.10.0 接口
删除
无 nat (内部,外部) 源动态 obj-10.1.10.0 接口
然后将其添加为
nat (内部,外部) after-auto 源动态 obj-10.1.10.0 接口
然后它就起作用了。