How to set up NAT for two servers using same port with ASDM ASA 5505

[James LaVeck]

Hi there,

We have a new installation of a ASA 5505 and are trying to get some NAT issues straightened out. Here is the scenario: On our internal network, we have two servers running Filemaker Server, a relational database server that clients connect with using port 5003. Our goal is to be able to allow users from the outside to access either of these servers as needed. I know how to set up a simple static NAT rule and matching Access rule in ASDM which would be fine for a case in which only one server using a given port is running on a network, but for simple static rules I seem to be blocked from entering a different translated port number from the orginal port number, which becomes a problem when two servers we need to access from the outside are running software using the same port number.

What is the simplest way to address this need? I am guessing that I need to set up a scenario like this, where port 5004 (or any arbitrarily choosen unused port, can be used to access the second server:

Outside user enters   FQDN:5004  and this translates to Database server # 1 as   192.168.1.40:5003

and

Outside user enters   FQDN:5003  and this translates to Database server # 1 as   192.168.1.38:5003

If so, what is the easist way to get this done? Or is there a better what to handle this scenario?

Thanks in advance,

James

[Dennis Mink]

I would create two objects and use object NAT

object network Obj_5004

host 192.168.1.40

object network Obj_5004

nat (inside,outside) static service tcp 5003 5004

object network Obj_5003

host 192.168.1.38

object network Obj_5003

nat (inside,outside) static service tcp 5003 5003

Of course you will need to open your outside interface for tcp ports 5003 and 5004 to make this happen