ACLs for NAT

Published on August 29 2013

Question:

I have a Cisco 2901 WS-C3560X-24T-L and need to expose an internal resource to the outside. I've set up the following:

ip nat inside source list 1 interface GigabitEthernet0/0 overload

ip nat inside source static tcp 1.1.1.1 4000 2.2.2.2 4000 extendable

ip nat inside source static tcp 1,1,1,1 44000 2.2.2.2 44000 extendable

ip nat inside source static tcp 1.1.1.1 443 2.2.2.2 443

ip nat inside source static tcp 1.1.1.1 80 2.2.2.2 80

ip nat inside source static 1.1.1.1 2.2.2.2

ip route 0.0.0.0 0.0.0.0 2.2.2.1

1.1.1.1 is the internal resoure IP

2.2.2.2 is the WAN IP assigned to the resource via NAT

2.2.2.1 is the gateway as defined by the ISP

Browsing and whatnot works fine so I know my basic NAT is correct but I suspect I need some ACLs to allow access from the outsdie becasue it isn't working now. Can someone point me in the right direction regarding the ACLs?

Answer:

Looks like you have a zone-based firewall configured (

http://www.cisco.com/en/US/products/sw/secursw/ps1018/products_tech_note09186a00808bc994.shtml).

You should see the following command somewhere:

zone-pair security xxxxx source out-zone destination in-zone (guessing on this name)

service-policy type inspect zzzzzz

then find the policy map entitled zzzzzz

policy-map type inspect zzzzzzz

class yyyyyy

Here you may have a class defined that is permitting some traffic in, look for the ACL referenced by that class. If you only have a class-default that is set to drop, you need to create a class map. Example below:

ip access-list extended NAT

permit tcp any 2.2.2.2 4000

permit tcp any 2.2.2.2 44000

permit tcp any 2.2.2.2 443

permit tcp any 2.2.2.2 80

!you also have a blanket NAT entry in there, if you intend to open all ports you need the following

permit ip any 2.2.2.2

class-map type inspect NAT

match access-group name NAT

policy-map type inspect zzzzzzzz

class type inspect NAT

pass WS-C3560X-24T-S