Objectives
The simulator ticks each one as soon as the network meets it.
Create object network WEB for host 172.16.1.10, with nat (dmz,outside) static 203.0.113.10.
Create access-list OUTSIDE-IN that permits icmp from any to object WEB, and apply it in on the outside interface.
R1 reaches 203.0.113.10, and the reply comes from SRV.
The rule lets in nothing else: R1 still cannot reach PC1’s translated address 203.0.113.1, and SRV cannot reach PC1.
show access-list OUTSIDE-IN shows hits on the rule.
Before you start
The ASA answers ARP for 203.0.113.10 on the outside (proxy ARP), which is how R1 reaches an address no interface has. An access rule names real addresses because untranslation happens before the rule is checked.
Concept
Firewall security levels and stateful inspection
Each firewall interface has a name and a security level from 0 to 100. Traffic may flow from a higher level to a lower one; the other way needs an access rule. The firewall remembers the connections it allowed, so their replies come back, but an ICMP echo reply only counts as a reply when ICMP is inspected.
Concept
Firewall NAT: three sections, applied in order
An ASA checks NAT rules in three sections. Manual (twice) rules come first, in the order you write them. Object (auto) rules come next, static before dynamic and the most specific first. Manual rules marked after-auto come last. Static NAT publishes a server, and the firewall answers ARP for the public address. Access rules name real addresses, because untranslation comes first.
