ASA 55108.4 Nat & Portforwarding

Question

因此，我试图将内部服务器上的内部服务转发到ASA外部接口上同一端口上的外部接口。

几天来，我一直在寻找解决办法，但什么也没找到。

下面是我配置的相关部分：

: Saved
:
ASA Version 8.4(2)
!
object service TCP-WebServer-8080
 service tcp source eq 8080
object network WebServer_Object_10.1.10.7
 host 10.1.10.7
object network obj-10.1.100.0
 subnet 10.1.10.0 255.255.255.0
!
access-list outsidein extended permit ip object-group OUTSIDE object-group INSIDE
access-list insideout extended permit ip object-group INSIDE object-group OUTSIDE
access-list webserveraccess extended permit tcp any object WebServer_Object_10.1.10.7 eq 8080
!
nat (inside,outside) source dynamic obj-10.1.10.0 interface
!
access-group webserveraccess in interface outside
access-group insideout in interface inside
!
object network WebServer_Object_10.1.10.7
 nat (inside,outside) static interface service tcp 8080 8080

以下是数据包跟踪器输出：

Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   1.2.3.4   255.255.255.255 identity

Phase: 2
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:

Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: NP Identity Ifc
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

它看起来像是被ACL丢弃了，但在我看来是正确的。关于我做错了什么，我能得到一些指导吗？

Answer 1

问题是我的(动态PAT)覆盖了我的静态PAT (端口转发)配置

nat (内、外)源动态obj-10.1.10.0接口

移除

没有nat (内、外)源动态obj-10.1.10.0接口

然后将其添加为

nat (内部、外部)-自动源动态obj-10.1.10.0接口

然后起作用了。