First, a brief summary of how we got to where we are. Our current internet connection comes in via a 10Mb ethernet handoff. This circuit is terminated on our Cisco 5520 ASA (outside int). When we got this circuit the IP block assigned was just a 2 host (/30) block and that was fine when we started. Now we have recently had the need to have a couple of public IPs accessible so we contact the ISP and we were told they assigned us an additional /29 block and are "routing it to our circuit". The problem is, I have no idea how to implement this to use these new IPs. My end goal is to be able to use IPs in the "new" IP block and NAT them to 2 different hosts on the inside network. How can I do this on the ASA?
My initial thought was to create a sub-interface off of the outside int but I was told that it wouldn't accomplish my goal due to the ASA not being able to do asymmetrical routing.
Let's use these IPs of an example
outside (184.108.40.206 /30)
inside (172.23.15.0 /24)
New IP Block (220.127.116.11 /29)
How do I implement a NAT that translates 18.104.22.168 to 172.23.15.50 and allows external hosts to hit my internal host via port 80?
This is what I came up with but unsure what else is needed do to it being a seperate subnet from the outside int.
static (inside,outside) 22.214.171.124 172.23.15.50 netmask 255.255.255.255
access-list acl_outside extended permit tcp any host 126.96.36.199 eq www
access-group acl_outside in interface outside
Please help and sorry if this is unclear.
You don't need to do anything else. You have it right. There is no need to have a subinterface. As long as the ISP is routing the new subnet to your firewall address, you are good to go.