topic Re: static nat on asa in Network Security

static nat on asa

mehta.rahul — Mon, 11 Mar 2019 09:36:30 GMT

Hi i need to change static association for a public ip to internal ip

right now i have following statment.

static (dmz,outside) 66.xx.xx.xx 192.168.50.91 netmask 255.255.255.255

it needs to be changed to

static (dmz,outside) 66.xx.xx.xx

192.168.51.14 netmask 255.255.255.255

what should I need to do ?

do i need to add no statment to previous statement and execute new ?

Re: static nat on asa

Jon Marshall — Wed, 21 Feb 2007 17:47:29 GMT

yes you should do

no static (dmz,outside) 66.xx.xx.xx 192.168.50.91 netmask 255.255.255.255

then

static (dmz,outside) 66.xx.xx.xx

192.168.51.14 netmask 255.255.255.255

You will then need to clear the xlate. Do not just enter "clear xlate" as it will remove all the xlates which will break all existing connections through the ASA.

clear xlate global 66.xx.xx.xx

HTH

Jon

Re: static nat on asa

khary — Wed, 21 Feb 2007 17:48:25 GMT

Yes you should put a "no" to remove the old statement then add the new statement. Ex:

no static (dmz,outside) 66.xx.xx.xx 192.168.50.91 netmask 255.255.255.255

static (dmz,outside) 66.xx.xx.xx 192.168.51.14 netmask 255.255.255.255

Re: static nat on asa

abinjola — Wed, 21 Feb 2007 21:25:38 GMT

Hello

You need to first remove the previous entry

no static (dmz,outside) 66.xx.xx.xx 192.168.50.91 netmask 255.255.255.255

Also you need to add a new static

static (dmz,outside) 66.xx.xx.xx 192.168.51.14 netmask 255.255.255.255

Then you need to clear the stale arp and xlate entries

cl xlate

cl loc

cl arp

See if it helps !