NAT ASA destination address

Hi
I am using a ASA 5540 running version 7.2(3) and would like to pass all http and https requests coming from the inside of the ASA to an external proxy server on the internet (All request need to pass to port 8080). I've tried using static commands but can only seem to NAT on the inside source address and not the destination address. Have also tried the same using dynamic NAT but again can only NAT on the source address.
Is there a way of NATing the destination address when coming from the inside of firewall?
Alternatively, if anyone can suggest another way of diverting http requests to a proxy server on the internet that would be appreciated.

It seems that when using the ACL in combination with the static translation statement (amounting to static policy NAT), the number of "real" addresses to be translated (as specified in the ACL) needs to equal to the number of addresses used for translation (which is only 1 address).
For example, my Cisco ASA 5505 took gave no errors when I entered the following:
Static Policy Nat - Accepted by ASA w/ no errors - (1 to 1 mapping of 1 real address to 1 mapped address)
access-list staticPOLICYnat line 1 extended permit ip host 172.16.0.2 host 74.125.45.105
static (inside,outside) 192.168.1.253 access-list staticPOLICYnat
The above policy static nat translates the real source address of 172.16.0.2 to 192.168.1.253 when 172.16.0.2 attempts connections to 74.125.45.105
Notice that there is a 1 to 1 mapping of the "real" address of 172.16.0.2 to the mapped address of 192.168.1.253.
However, in the past I also wondered if I could translate more than one real addresses and map them to one global address using the ACL and static nat combo (which amounts to static policy nat). But I have not been able to get that to work. For example, entering the following provided me with the "global address overlaps with mask" error.
Static Policy Nat - Rejected By ASA w/ error of "global address overlaps with mask" - (many to 1 mapping of multiple real addresses to 1 mapped address)
access-list staticPOLICYnat line 1 extended permit ip any host 74.125.45.105
static (inside,outside) 192.168.1.253 access-list staticPOLICYnat
The above configuration was rejected by my ASA 5505 with an error of "global address overlaps with mask"
In my experience, it is, however, possible to map/translate more than one "real" IP addresses to one mapped/translated IP address using dynamic policy NAT. So for example, the following was accepted by my ASA with no errors.
Dynamic Policy Nat - Accepted by ASA w/ no errors - (many to 1 mapping of multiple real addresses to 1 mapped address)
access-list staticPOLICYnat line 1 extended permit tcp any host 74.125.45.105
nat (inside) 2 access-list staticPOLICYnat
global (outside) 2 192.168.1.253
If anyone knows how to translate or map multiple IP addresses to a single IP address using static policy NAT, please do share.
Best Regards,
David

Similar Messages

Natting of Destination Address

Is is possble to nat the destination address. What I am trying to do it change DNS servers. I would like to have traffic going to the old address be natted but traffic going to the new address not be natted. Finally if the DNS devices generates traffic it would not be natted.

I understand it may be tricky, that is why I posted it. The DNS server is an internal server so from the router point of view I can make it either inside or outside. Currently it is connected directly to a 6509, but the thought is to put a 3640 between the DNS server and the 6509 and using static routes on the 6509 direct traffic for either address to the 3640 and then to the new server. My thought was to do nating on the 3640, but as I indicated I have not be able to get the router to change or nat the destination address and also not to nat traffic to the new address or new traffic coming from the DNS server.
If you are someone could give a specific config or point me to a cisco document that explains how to do this it would be great.

Access another host on same subnet through Nat'd IP address

I appreciate any help in advance, I have a requirement to monitor a host's external IP address, the monitoring host (host A) initiating the request is located in the same DMZ subnet as the destination host (host B) I want to monitor, both are NAT'd to external IP addresses, I was expecting to see a request going out from host A, getting NAT'd to its respective external IP address and then coming back in through the external interface to reach the Nat'd IP address of host B. is this how NAT will be handled by the ASA or am I missing something here? thanks again.

Borman,
Its more complicated than that, consider the following scenario:
                            20.20.20.0/24
               ASA------------------------------Internet
                  | (DMZ)
             Switch
     Host A          Host B
   10.1.1.10      10.1.1.100
                      20.20.20.20 (Nat outside address)
Basically you want to monitor your host B using its public IP address, normally your NAT configuration (in case of version 8.2 and prior) would be something like this:
nat (DMZ,outside) 20.20.20.20 10.1.1.100
nat (DMZ) 1 0.0.0.0 0.0.0.0
global (outside) 1 interface
When going from Host A to host B, two translations should occur, first is the Unstranslate from 20.20.20.20 to 10.1.1.100 (By internal process of the ASA), then once it is unstranslated, the route-lookup comes in game. Firewall notices that is on the same interface as the source of the packet so we reach our first impass. The ASA does not support same security traffic by default. So we overcome this issue with the following command:
same-security-traffic permit intra-interface
Now that is done, so we move to the next packet process, the ASA tries to check if there is any NAT translation for a packet coming from the DMZ and going to the same DMZ. As you can see there is a "nat (DMZ) 1 0.0.0.0 0.0.0.0", that tells the firewall that everything coming from the DMZ should be translated, we hit that NAT and since the outgoing interface is the same as the source interface (DMZ) there is no global command, hence you will see an error that states, No translation group found. Here is how we overcome that issue
Global (DMZ) 1 interface
This will translate requests from the DMZ interface going to that same interface to the DMZ IP address, on the server 10.1.1.100, the connection will be seeing as it came from the firewall, the packets will be sent to the firewall again, hence avoiding asymmetric routing.
If running version 8.3 or higher, the concept is the same, but the commands change a bit.
8.3
same-security-traffic permit intra-interface
object network Server_Public
host 20.20.20.20
object network Server_Private
host 10.1.1.100
object network Any
subnet 0.0.0.0 0.0.0.0
Nat (DMZ,DMZ) source dynamic Any interface destination static Server_Public Server_Private
So bottom line, configuration needed on 8.2
global (outside) 1 interface
same-security-traffic permit intra-interface
Configuration for 8.3
same-security-traffic permit intra-interface
object network Server_Public
host 20.20.20.20
object network Server_Private
host 10.1.1.100
object network Any
subnet 0.0.0.0 0.0.0.0
Nat (DMZ,DMZ) source dynamic Any interface destination static Server_Public Server_Private
Hope this helps a bit.
Mike

NAT Translating Destination IP and Port

Hi I have posted this in the Routing and switching forum but thought i'd post it in here too as it realted to web security
I am struggling with NAT translation on a Cisco router. I want to translate all HTTP traffic that exits my network to change the destination IP to 117.166.1.1 and translate the destination port from tcp 80 to tcp 3128.
i.e. If a PC with an IP 192.168.1.10 enters 200.1.1.1 into the webbrowser, instead of the traffic going to 200.1.1.1 on port 80, it will be directed to 117.166.1.1 on port 3128
This is because I am using a cloud url filter and want all HTTP traffic to go to that proxy.
I believe this can be done with an outside NAT but I am unable to get this work. Anyone know how to do this?
Thanks
K

Hi,
If you want to block all the connections to your computer on 25 port, you need to add My IP Address as the Destination address and set Any IP Address as the Source address in your computer.
In addition, if you choose Mirrored, it will mirror the filters automatically configures both inbound and outbound filters. In your scenario, you would uncheck it.
For more detailed information, please refer to the link below:
Step-by-Step Guide to Internet Protocol Security (IPSec)
Best regards,
Susie

Tracing TCP Source/Destination Addresses/Ports for ongoing connections

On Solaris 10 U4 through U7, I'm trying the following just to perform basic tracking of TCP source/destination addresses and ports, using code similar to what is available in tcpsnoop_snv and tcptop_snv.
The odd thing is that the addresses/ports appear to be zeroed out - are they being cached outside of the conn_t data structure?
#!/usr/sbin/dtrace -Cs
#pragma D option switchrate=10hz
#pragma D option bufsize=512k
#pragma D option aggsize=512k
#include <sys/file.h>
#include <inet/common.h>
#include <sys/byteorder.h>
#include <sys/socket.h>
#include <sys/socketvar.h>
/* First pass, for all TCP Read/Write actions, collect source/destination
 IP + Port - after a few secs, print them all out */
fbt:ip:tcp_send_data:entry
/* Outgoing TCP */
self->connp = (conn_t *)args[0]->tcp_connp;
fbt:ip:tcp_rput_data:entry
/* Incoming TCP */
self->connp = (conn_t *)arg0;
fbt:ip:tcp_send_data:entry,
fbt:ip:tcp_rput_data:entry
/self->connp/
/* fetch ports */
#if defined(_BIG_ENDIAN)
self->lport = self->connp->u_port.tcpu_ports.tcpu_lport;
self->fport = self->connp->u_port.tcpu_ports.tcpu_fport;
#else
self->lport = BSWAP_16(self->connp->u_port.tcpu_ports.tcpu_lport);
self->fport = BSWAP_16(self->connp->u_port.tcpu_ports.tcpu_fport);
#endif
/* fetch IPv4 addresses */
this->fad12 =
 (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[12];
this->fad13 =
 (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[13];
this->fad14 =
 (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[14];
this->fad15 =
 (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[15];
this->lad12 =
 (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[12];
this->lad13 =
 (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[13];
this->lad14 =
 (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[14];
this->lad15 =
 (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[15];
/* At this point, this->{f|l}ad1{2345}->connua_v6addr.connua_{f|l}addr._S6_un.S6_u8
 are empty - where is this data? */
}

http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/css11500series/v7.50/command/reference/CmdGrpC.html#wp1139667
portmap [base-port base_number|disable|enable|number-of-ports number|vip-address-range number]
disable
Instructs the CSS to perform Network Address Translation (NAT) only on the source IP addresses and not on the source ports of UDP traffic hitting a particular source group. This option does not affect TCP flows.
For applications with high-numbered assigned ports (for example, SIP and WAP), we recommend that you preserve those port numbers by configuring destination services in source groups. Destination services cause the CSS to NAT the client source ports, but not the destination ports.
Note If you disable flows for a UDP port using the flow-state table and configure the portmap disable command in a source group, traffic for that port that matches on the source group does not successfully traverse the CSS.
The CSS maintains but ignores any base-port or number-of ports (see the options above) values configured in the source group. If you later reenable port mapping for that source group, any configured base-port or number-of ports values will take effect. The default behavior for a configured source group is to NAT both the source IP address and the source port for port numbers greater than 1023.
There is no possibility to disable it for TCP.
We need to source nat the port to guarantee that the server response comes back on the same module/CPU and the internal packet allocation algorithm is based on src and dst ports.µ
Gilles:

Trusted RFC and Remote logon not possible due to Nat'd IP addresses

Hi,
We are trying to connect our SolMan 4 to our cusotmers ECC 6 and BI7 systems, the systems are off site and the IP addresses for the customers systems are nat'd when they come in and go out from our Network.
The problem we get is that we cannot set up Trusted systems or Remote Logon to these systems due to issues with the Nating of the IP adresses. We can set up all standard RFC's after adding the the appropriate addresses into the hosts file and they work fine. But the trusted RFC does not set up properly and the BACK rfc from the satelite system does not get set up properly. What appears to happen is that when you try to start a remote session SAP goes to the satelite system and finds the Instance Name and the local IP address rather than the NAT'd IP address and try's to open a session from there. I found this by going into the trusted RFC in SM59 and then going to Extra's, System Information, Target System, this then tells me the Target System information, where it shows the System ID and IP address (which is the incorrect IP address).
Anyone know how we can get the system to try to have the correct IP adress in the target system information so that we can get Remote Logon's to work??
Cheers

Hi Carl,
Based on your explanation about Nating,, how will the RFC determine to connect to Solmans internal IP after it has been directed to the IP for the Router connection.
I feel it is like configuring a jump of RFCs from one IP to another in a single chain.
Can this be done ?? I mean we have to specify an IP in the RFC connection right.. so how will the automatic jumping of IPs be done.
Sorry not answering the question but its very interesting and wanted to know.
Also went trough note # 148832, might help.
Regards,
Kaustubh.
Edited by: Kaustubh Krishna on Aug 13, 2009 12:17 PM

Specific Destination Address Lookup?

Now on a dedicated GPS device, you can enter an exact destination address, and the GPS device can find it, quickly, and create a route to your destination.
Does Nokia Ovi Maps support direct address lookup on the phone? I have not been able to get it to work.
Now you can locate an address on the phone by finding it on the map, save it to favorites, but this is tedious and time consuming, to get the street number right.
You can also enter the address online to Ovi Maps, and sync the location to the phone into your Favorites. This works well too.   Now you have your precise destination.
Am I missing something or is this a limitation with respect to the downloaded maps to the phone?
To have precise address to GPS coordinates on the phone offline to all known addresses would make the maps too large.
This is using the phone offline. For example, doing route planning, inside your house with no GPS or network connection.
The second case is you have your current GPS position known to the phone, since you are outside, yet the phone cannot determine your specific destination, when you enter it. In this case, you only have a GPS satellite connection, nothing else.   I cannot enter a destination here either.
My belief is you must be "online", either WiFi or with a phone data plan, to get specific destinations.   Is this belief correct?

Biff27 wrote:Does Nokia Ovi Maps support direct address lookup on the phone?
To have precise address to GPS coordinates on the phone offline to all known addresses would make the maps too large.
My belief is you must be "online", either WiFi or with a phone data plan, to get specific destinations.   Is this belief correct?
Hi Biff27
The answer appears to be that it is regional variation whether or not you can navigate "Offline" to a specific address. Using v3.04 with UK maps downloaded there is no problem but talking here about small surface area compared with other countries. At one point I had world maps downloaded together with all "ClientIndex" so it certainly wasn't absence of available data to blame but no comparison to that on remote server.
Happy to have helped forum in a small way with a Support Ratio = 37.0

Syslog Destination Address

Hi there,
since my ABSE is constantly rebooting I'm trying to get some logs. I can't use the Airport Utility for that purpose since it's not streaming the logs. Also, as soon as the ABSE reboots it dumps the logs.
So I'm trying to stream the logs to my MacBook using the Advanced/Logging & SNMP/Syslog Destination Address.
In that field I've entered the IP address of my MacBook. I've connected it using Ethernet, disabled Airport. Syslog Level to "Debug" -> Update
Then I open my Console and nothing, I've looked in the different Logs everywhere and can't find anything.
Has anyone got it working?
Micha

Hi,
I have not got it working, I would also like to do the same thing, but I believe it is quite tricky. By default I believe that OS X 10.4 is NOT configured to be able to receive syslog log messages over the network.
The program that actually listens for log messages, from the network or from local apps, is called syslogd. www.macosxhintss.com hints has a somewhat confusing write-up on how to reconfigure it to receive messages from the network (http://www.macosxhints.com/article.php?story=20060327074531639). However, this involves tampering with files off of the /System/Library subdirectory, so I'd rather not risk it.
MacBook Pro Mac OS X (10.4.9)
MacBook Pro Mac OS X (10.4.9)

Wrong Destination Address?

Does anyone know what the wrong destination address message, below, means?
<NT Performance Pack> NATIVE: created IoCompletionPort successfully.
IoPort=0x000009e8
? ??? 26 17:43:32 GMT+00:00 2000: <ListenThread> Adding address:
medusa.internal.talmai.com/10.0.0.127 to licensed client list
? ??? 26 17:43:32 GMT+00:00 2000: <NT Performance Pack> Allocating: '2'
NT reader threads
? ??? 26 17:43:32 GMT+00:00 2000: <WebLogicServer> WebLogic Server
started
? ??? 26 17:43:33 GMT+00:00 2000: <ConMan> CMD_IDENTIFY_REQUEST for this
JVM has the wrong destination
address -8494283096926994801S10.0.0.127:[7101,7101,7102,7102,7101,-1]
? ??? 26 17:43:33 GMT+00:00 2000:<E> <ConMan> Message for this server has
the wrong destination
address -8494283096926994801S10.0.0.127:[7101,7101,7102,7102,7101,-1]
? ??? 26 17:43:33 GMT+00:00 2000: <ConMan> CMD_IDENTIFY_REQUEST for this
JVM has the wrong destination
address -8494283096926994801S10.0.0.127:[7101,7101,7102,7102,7101,-1]
? ??? 26 17:43:33 GMT+00:00 2000:<E> <ConMan> Message for this server has
the wrong destination
address -8494283096926994801S10.0.0.127:[7101,7101,7102,7102,7101,-1]
- Avi
s/\be(\w+)/e-\1/g;

I saw the same problem on our Solaris server with SPA.
Can you specify which bug number this is involved?
Thanks.
Winnie
"Avi Kivity" <[email protected]> wrote in message
news:[email protected]..
WLS 5.1.0 SP7 on Windows 2000 SP1.
- Avi
s/\be(\w+)/e-\1/g;
"Avi Kivity" <[email protected]> wrote in message
news:[email protected]..
Does anyone know what the wrong destination address message, below,
means?
<NT Performance Pack> NATIVE: created IoCompletionPort successfully.
IoPort=0x000009e8
? ??? 26 17:43:32 GMT+00:00 2000: <ListenThread> Adding address:
medusa.internal.talmai.com/10.0.0.127 to licensed client list
? ??? 26 17:43:32 GMT+00:00 2000: <NT Performance Pack> Allocating:'2'
NT reader threads
? ??? 26 17:43:32 GMT+00:00 2000: <WebLogicServer> WebLogic Server
started
? ??? 26 17:43:33 GMT+00:00 2000: <ConMan> CMD_IDENTIFY_REQUEST forthis
JVM has the wrong destination
address -8494283096926994801S10.0.0.127:[7101,7101,7102,7102,7101,-1]
? ??? 26 17:43:33 GMT+00:00 2000:<E> <ConMan> Message for this server
has
the wrong destination
address -8494283096926994801S10.0.0.127:[7101,7101,7102,7102,7101,-1]
? ??? 26 17:43:33 GMT+00:00 2000: <ConMan> CMD_IDENTIFY_REQUEST forthis
JVM has the wrong destination
address -8494283096926994801S10.0.0.127:[7101,7101,7102,7102,7101,-1]
? ??? 26 17:43:33 GMT+00:00 2000:<E> <ConMan> Message for this server
has
the wrong destination
address -8494283096926994801S10.0.0.127:[7101,7101,7102,7102,7101,-1]
- Avi
s/\be(\w+)/e-\1/g;

DESTINATION ADDRESS IN CUSTOMER INVOICE

DEAR ALL,
my customer he would like that the material should be delivered at other destination address different than his permanent address mentioned in his master data and in the invoice ,please how to make the distination address and make it appear ,please give me paths
thanks,

Hi
As your customer needs the material should be delivered to another destination address,in customer master record->general data tab->maintain contact details.
Second option is maintain another ship to party and bill to party to the customer with the address where the material has to be delivered.
Regards
Srinath

Error "Extend the destination address using the location input help"

Hi experts,
I got warning while creating travel expense from existing travel request.
the warning appear like this "Extend the destination address using the location input help"
I don't want user to enter detail of address trip destination.
how to avoid this?
thanks
Edited by: nzworld on Apr 29, 2011 5:42 AM

Hi,
If you are using ESS and you get the warning message when you enter details for a particular expense type. Please follow the config and hide the location details. Then you will not get this error message.
SAP Customizing Implementation Guide > Financial Accounting (New) > Travel Management > Travel Expenses > Dialog and Travel Expenses Control > Dialog Control > Field Control for Additional Receipt Information.
Enter your trip provision variant, select the expense type for which you dont want to enter the location details and then select details. Search for the variable location, select hide radio button and save.
Please let me know if you have further clarifications.
Regards,
Raj

ISDN Failed - Destination address is non-ISDN

Hi,
I am using a BRI ISDN to connect to remote site BRI ISDN.
When use debug isdn q931, the following display:
ISDN BR0 Q931: RX <- ALERTING pd = 8 callref = 0xAC
Progress Ind i = 0x8282 - Destination address is non-ISDN
Is there any solution for this? I have change the isdn T310 timer but it doesn't work.
Thanks.

No, the other end is another company which does not allow dial out.
Below is the debug isdn event and debug isdn q931:
ISDN BR0 Q931: RX <- SETUP_ACK pd = 8 callref = 0xB4 Channel ID i = 0x89
ISDN BR0 EVENT: process_rxstate: ces/callid 1/0x8034 calltype 1 HOST_INFORMATION
ISDN BR0 Q931: RX <- CALL_PROC pd = 8 callref = 0xB4
ISDN BR0 EVENT: process_rxstate: ces/callid 1/0x8034 calltype 1 HOST_PROCEEDING
ISDN BR0 Q931: RX <- ALERTING pd = 8 callref = 0xB4 Progress Ind i = 0x8282 - Destination address is non-ISDN
ISDN BR0 EVENT: process_rxstate: ces/callid 1/0x8034 calltype 1 HOST_ALERTING
BRI0: wait for isdn carrier timeout, call id=0x8034
ISDN BR0 EVENT: UserIdle: callid 0x8034 received ISDN_HANGUP (0x1)
ISDN BR0 Q931: TX -> DISCONNECT pd = 8 callref = 0x34 Cause i = 0x8090 - Normal call clearing
ISDN BR0 Q931: RX <- RELEASE pd = 8 callref = 0xB4 Cause i = 0x8090 - Normal call clearing
ISDN BR0 EVENT: process_rxstate: ces/callid 1/0x8034 calltype 1 HOST_DISCONNECT_ACK
ISDN BR0 Q931: TX -> RELEASE_COMP pd = 8 callref = 0x34
Thanks.

Wrong Destination Address Messages

Hi, i've read the posting about how I can receive this message if the old WebLogic is still running while I start a new one. This is not the case for me, I issue the 'kill -9' command on the WebLogic process and wait several seconds, then issue the start up commands, and still get a mile long listing of these errors. Any ideas?

You will get that message if you start a new WLS before the old
one has finished exiting - and it will continue on. You will likely
need to kill the new JVM and wait until it is really, really dead
before starting a new one.
Mike
"Assaf Pazner" <[email protected]> wrote:
We keep getting these messages. What does it mean?
Thu Jan 04 14:15:15 CST 2001: <ConMan> CMD_IDENTIFY_REQUEST
for this JVM
has the wrong destination address
7674211280516062892S172.17.20.102:[80,80,443,443,80,-1]
We are running WLS 5.1 SP7, JDK 1.3, NT 4.0.
Thanks,
Assaf Pazner

"Invalid Destination Address" for MMS messages

I got an HTC One M8 about a month ago, and everything has been working great. However, the last 2 or 3 days, I haven't been able to send MMS messages. I know that the numbers are correct, because I have been grabbing them straight from my contacts, and I have triple checked them. I've tried about 5 different pictures with 5 different contacts, and every time I do, a red triangle with an explanation point in the middle comes up saying "invalid destination address". I have no idea what happened, as it's been working up until the last few days. I have tried with and without WiFi, force stopped my messages and cleared the cache. Nothing works. Can anyone help, please?

RDSHARP39, thanks for trying all of those steps for us. I want to make sure that we get the device back up and running like it is suppose to. Are you able to receive picture messages from your contacts? Have you been able to power off the device and pull the sim card out for a good 10-15 seconds: http://vz.to/1B3J1vX After that time frame please place the sim card back into the device and re-try sending a picture message. Keep us posted.
KevinR_VZW
Follow us on Twitter @VZWSupport

Wront destination address

Since moving to weblogic 5, I get these in my weblogic log all the time,
any ideas why? They dont seem to be causing application problems, but
they are annoying to look at.
Wed Apr 18 15:45:15 EDT 2001: <ConMan> CMD_IDENTIFY_REQUEST for this
JVM has the wrong destination address
2115781640735362353S(MYIP):[8005,8005,7002,7002,8005,-1]
Wed Apr 18 15:45:15 EDT 2001:<E> <ConMan> Message for this server has
the wrong destination address
2115781640735362353S(MYIP):[8005,8005,7002,7002,8005,-1]

Hi Datta
No, there are no more details available for this error. I even can't open description of this error by duble clicking on it- it does not work.
Best Regards
Andrey

NAT ASA destination address

Similar Messages

Maybe you are looking for