--- On Sun, 4/15/12, Gary Smith <[email protected]> wrote: > From: Gary Smith <[email protected]> > Subject: Re: [c-nsp] Configure NAT to use a certain port range for source > ports > To: "Jason Lixfeld" <[email protected]>, [email protected] > Date: Sunday, April 15, 2012, 6:23 AM > On 15/04/2012 13:59, Jason Lixfeld > wrote: > > Hi all, > > > > I have an inside NTP server behind an IOS NAT box that > is trying to sync time from an outside NTP server. NAT > changes the source port to some low port, but due to a bug > in the NTP implementation on the outside NTP server, source > ports< 123 are rejected. So - is there a way > that I can configure NAT to use a high source port when the > destination port is UDP/123? > > > > T > Could you not use Static PAT here? It seems like it'd > probably be a > valid way to solve the problem rather than hoping that the > NAT won't hit > a port that the NTP server disagrees with. > > http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/nat_staticpat.html
If I understand correctly - you are attempting to have NTP Server on inside sync with NTP Server on outside. That would make it a "symmetric" connection where the source and destination ports would be udp 123. Using NAPT/PAT would break NTP. How about "static-NAT" only: static (inside outside) <public ip> <real-ip of inside NTP server> this would leave you source-port intact. on the inside-int acl applied inbound, you probably want to only-allow udp 123 to public-ntp server ip.addr from real-ip.addr of ntp server on the inside. hth, ./Randy _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
