PAT port range

Question

Hi,
I'm looking for a way to avoid doing 999 individual port address translations for ports in a range 1-999 for the same protocol.
I'm not finding anything that asa code v9.11 will allow.
I have the service objects defined but cannot find a way to get the nat statement to allow the service object.
object network foobarhost 192.168.100.22nat (inside,outside) static interface service fooservice fooservice
Hope I'm missing something here. Any help appreciated.
Thanks.

Answer 1

Hi,
Seems there is a bug in the 9.1 ASA software as I tried to configure this first with that software. That gave a wierd result and I checked another post on these forums that related to a similiar problem
I then booted my ASA with 8.4(5) software and the NAT is now working normally. So I imagine you will have to wait for a correcting software or move to a older software to get it working in the meanwhile
Heres the configuration I did and a "packet-tracer" output to test it
NAT CONFIGURATION
Where
SERVICE-LOCAL = The actual port range on the LAN
SERVICE-MAPPED = The corresponding NATed/Mapped port range on the WAN
SERVER-LOCAL = Server IP on the LAN
SERVER-MAPPED = Server IP NATed/Mapped on the WAN
nat = The NAT configuration
Y.Y.Y.Y = One of my public IP addresses assigned to this NAT configuration
X.X.X.X = My server LAN IP address
object service SERVICE-LOCAL
service tcp source range 5000 6000
object service SERVICE-MAPPED
service tcp source range 15000 16000
object network SERVER-LOCAL
host X.X.X.X
object network SERVER-MAPPED
host Y.Y.Y.Y
nat (LAN,WAN) source static SERVER-LOCAL SERVER-MAPPED service SERVICE-LOCAL SERVICE-MAPPED
PACKET-TRACER TEST
Where
WAN = My ASAs "outside" interface
1.2.3.4 = Random address behind the WAN interface
Y.Y.Y.Y = One of my public IP addresses assigned to this NAT configuration
X.X.X.X = My server LAN IP address
ASA# packet-tracer input WAN tcp 1.2.3.4 20000 Y.Y.Y.Y 15000
Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list
Phase: 2
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
nat (LAN,WAN) source static SERVER-LOCAL SERVER-MAPPED service SERVICE-LOCAL SERVICE-MAPPED
Additional Information:
NAT divert to egress interface LAN
Untranslate Y.Y.Y.Y/15000 to X.X.X.X/5000
Link to the dicussion with the NAT problem:
https://supportforums.cisco.com/thread/2196562?tstart=60
Link to the BugID (CLICK THE BUG ID AT THE END OF THE LINK)
https://www.cisco.com/cisco/psn/bssprt/bss?searchType=bstbugidsearch&page=bstBugDetail&BugID=CSCud64705
Finally the same NAT configuration as above but while running ASA software 9.1(1)
Where
WAN = My ASAs "outside" interface
1.2.3.4 = Random address behind the WAN interface
Y.Y.Y.Y = One of my public IP addresses assigned to this NAT configuration
X.X.X.X = My ASA WAN interface IP address
ASA(config)# packet-tracer input WAN tcp 1.2.3.4 20000 Y.Y.Y.Y 15000
Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   X.X.X.X  255.255.255.248 WAN
Result:
input-interface: WAN
input-status: up
input-line-status: up
output-interface: WAN
output-status: up
output-line-status: up
Action: drop
Drop-reason: (no-route) No route to host
Hope the above information has been helpfull. If so please rate
- Jouni