Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

ASA - Translate Destination IP only?

Hello All,

I have a public IP and port (1.1.1.1:80) that is translated to a private IP:

static (inside,outside) 1.1.1.1 192.168.1.1 netmask 255.255.255.255

The ACL applied inbound on the outside interface permits any hosts to 1.1.1.1:80.

My question is can I policy translate the destination IP:port from outside clients that match specified subnets? (ie: hosts coming from 2.2.2.0/8 to 1.1.1.1:80 are translated to 1.1.1.2:81) ?

(and any necessary static and ACL additions would be performed).

Thanks,

Christopher

1 ACCEPTED SOLUTION

Accepted Solutions
New Member

Re: ASA - Translate Destination IP only?

After reading, trying and remembering, the answer is:

NO, you can't map a ip:port to two different ip:port destinations

If you can't change the destination ip:port, maybe can do a dns trick or somthing like that.

10 REPLIES
New Member

Re: ASA - Translate Destination IP only?

I dont understand why you would want to do this if both public IPs are in the same range?

if they are then just have a static nat to 1.1.1.2:81 and limit access to it with an acl?

New Member

Re: ASA - Translate Destination IP only?

Basically, the public IP is advertised in DNS, and could be hard-coded in an application. However, depending on the client source IP, they may need to be serviced by a different backend server.

New Member

Re: ASA - Translate Destination IP only?

I don't understand.

Do you need that clients from 2.2.2.0 be mapped to 192.168.1.1 and clients from 3.3.3.0 mapped to 192.168.1.22 for example?

New Member

Re: ASA - Translate Destination IP only?

Yes, that's basically it. Both sets of clients would attempt to connect to 1.1.1.1:80 (for example), but their true destination IP:port would be decided based on their source IP. Does that help clarify?

New Member

Re: ASA - Translate Destination IP only?

I am preparing the lab, if the phone doesn't ring, I will tell you my results in a few hours.

New Member

Re: ASA - Translate Destination IP only?

After reading, trying and remembering, the answer is:

NO, you can't map a ip:port to two different ip:port destinations

If you can't change the destination ip:port, maybe can do a dns trick or somthing like that.

New Member

Re: ASA - Translate Destination IP only?

Thanks. I did some basic reading/trying and couldn't see it happening, but it was an odd case and you never know...

New Member

Re: ASA - Translate Destination IP only?

This kind of policy nat and balanced internet connection are two of the most important ASA missing features.

Thanks 4 rating

New Member

Re: ASA - Translate Destination IP only?

the solution to your problem is to use checkpoint :-)

New Member

Re: ASA - Translate Destination IP only?

Oh OK :)

We could perform this stuff post-ASA (ie: on an F5 BIG-IP), but that equipment isn't in place at the moment. I was hoping that the ASA a couple more features than the thousands it already possessed!

227
Views
0
Helpful
10
Replies