Single Public PAT to multiple Internal

Answered Question
Apr 8th, 2009
User Badges:

ASA 5510


Need to NAT single public IP to multiple internal IPs.


Outside:1.1.1.1/25 -> DMZ:192.168.1.10/25

while...

Outside:1.1.1.1/443 -> Inside:192.168.2.10/443

and

Outside:1.1.1.1/1352 -> Inside:192.168.2.10/1352


Initially tried (via ASDM) static P/NAT from DMZ to Outside using Port Address Translation with port 25 both in and out.

Then adding static P/NAT from Inside to Outside using Port Address Translation for port 443.


Problem arises when I want to specify the third static P/NAT for port 1352, or when I leave PAT on for DMZ host, but turn it off for the Inside host.


The ultimate goal is for port 25 on the public IP to go to the DMZ host while 443 and 1352 get sent to the Inside host.


How can I accomplish this? It's OK to say the ASDM won't let you do this, but I won't be so happy to hear that the ASA cannot accomplish this knowing that there are a bunch of half-assed appliances out there that DO handle this.


Thanks for helpin me out yet again!

Correct Answer by roshan.maskey about 8 years 3 months ago

Hi,


Cisco ASA does support that. Please try from CLI.


static(dmz,outside) tcp 1.1.1.1 25 192.168.1.1 25

static(inside,outside) tcp 1.1.1.1 443 192.168.2.1 443

static(inside,outside) tcp 1.1.1.1 1352 192.168.2.1 1352


Also add these access-list in outside interface access-list.


access-list outside_in extended permit tcp any host 1.1.1.1 eq smtp

access-list outside_in extended permit tcp any host 1.1.1.1 eq https

access-list outside_in extended permit tcp any host 1.1.1.1 1352




  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
roshan.maskey Wed, 04/08/2009 - 17:06
User Badges:

Hi,


Cisco ASA does support that. Please try from CLI.


static(dmz,outside) tcp 1.1.1.1 25 192.168.1.1 25

static(inside,outside) tcp 1.1.1.1 443 192.168.2.1 443

static(inside,outside) tcp 1.1.1.1 1352 192.168.2.1 1352


Also add these access-list in outside interface access-list.


access-list outside_in extended permit tcp any host 1.1.1.1 eq smtp

access-list outside_in extended permit tcp any host 1.1.1.1 eq https

access-list outside_in extended permit tcp any host 1.1.1.1 1352




bsisco Thu, 04/09/2009 - 09:08
User Badges:

I should've known that even though the GUI ASDM complained about it and even though the CLI (via the GUI) complains about it but let's it go that it was possible.


Spoiled by yet another GUI.


Thanks Roshan

Actions

This Discussion