topic Re: What would be the translated sources in NAT rule on Cisco FMC for in Network Security

What would be the translated sources in NAT rule on Cisco FMC for FTD?

CiscoBrownBelt — Mon, 15 Jul 2024 18:48:17 GMT

Just want to be sure. So If establishing connection from internet to private internal server, the translated source would be the private IP want to nat the public IP to? The Translated destination would be the IP of the internal server?

Re: What would be the translated sources in NAT rule on Cisco FMC for

MHM Cisco World — Mon, 15 Jul 2024 18:53:05 GMT

OUT (internet)- FTD -IN

the static NAT is bidirectional
you can use
IN

OUT

private IP

port X

ANY

interface

port X

Any

this how NAT need to config

MHM

Re: What would be the translated sources in NAT rule on Cisco FMC for

CiscoBrownBelt — Mon, 15 Jul 2024 18:59:25 GMT

Not sure if I am tracking. So to the translated source would be the private IP I want to use for the external public IP/device trying to access internal server? The Translated destination would be the actual private IP of the internal server?

Re: What would be the translated sources in NAT rule on Cisco FMC for

MHM Cisco World — Mon, 15 Jul 2024 19:04:21 GMT

The traffic initiate from OUT (internet) client to server

The source is client public IP

The destiantion will be public IP (mapped IP of server)

Since the NAT config IN to OUT

The destiantion public IP (server mapped IP) NATing to private IP (real server IP)

Source client public IP not NATing since we use any to any.

MHM

Re: What would be the translated sources in NAT rule on Cisco FMC for

CiscoBrownBelt — Mon, 15 Jul 2024 19:09:05 GMT

So per my screen shot, the Translated Sources is the internal private IP I want to NAT the public/Out host IP to? And the translated destination is the actual internal IP of the server?

Re: What would be the translated sources in NAT rule on Cisco FMC for

CiscoBrownBelt — Mon, 15 Jul 2024 19:16:33 GMT

So source = static
Source Int Obj = Outside
Desination Int Obj = Inside
Original Source = my public host IP that wants access to internal server
Original Destination = Public IP/GW for internal server
Original Services = say https
Translated Sources = my public host IP that wants access to internal server
Translated Destination = actual real private IP of internal server need access for

Re: What would be the translated sources in NAT rule on Cisco FMC for

MHM Cisco World — Mon, 15 Jul 2024 19:18:40 GMT

Re: What would be the translated sources in NAT rule on Cisco FMC for

CiscoBrownBelt — Tue, 16 Jul 2024 11:02:21 GMT

This is for connection from an external outside host to internal server that has private IP. Are you referencing from internal server to external host connection?

Re: What would be the translated sources in NAT rule on Cisco FMC for

MHM Cisco World — Tue, 16 Jul 2024 11:35:57 GMT

This NAT since it static it bidirectional

It NATing

From server to client

From client to server

MHM

Re: What would be the translated sources in NAT rule on Cisco FMC for

CiscoBrownBelt — Tue, 16 Jul 2024 12:00:34 GMT

I only want the server reachable from one external host out in internet. Internal private IP subnet server is on already has internet access (so from internal to external of course). You are saying just enter NAT in same fashion but enter the external host as the destination?

Re: What would be the translated sources in NAT rule on Cisco FMC for

Marius Gunnerud — Wed, 17 Jul 2024 09:19:25 GMT

How you set up NAT is really up to you, with regard to where you specify the source and destination. Some prefer to have the internet / external network as the source (I suppose for visualization purposes) and others like the source to be the internal network (this is my preference). You can also limit the NAT rule to a specific port and if you are using the FTD Outside / external interface for this connection then you will need to do that or you will possibly break other connections.

Just keep in mind that static manual NAT are bi-directional by default which is why source and destination are interchangeable and will work if set up correctly.

You will also need access rules on the Outside / external interface on the FTD allowing access from the remote public IP to the internal private IP of the server.

Re: What would be the translated sources in NAT rule on Cisco FMC for

MHM Cisco World — Wed, 17 Jul 2024 09:27:13 GMT

You are saying just enter NAT in same fashion but enter the external host as the destination? <<- in my previous comment I never mention that we need NATing the destination
I think I know what you confuse about
static NAT for server from private to public IP can config in two way
1- IN OUT <<- interface
the source is private IP of server and it NATing to public IP
2- OUT IN <<- interface
the destination is Public IP of server and it NATing to private IP

there is no different since as I mention before it bidirectional NAT

if you have more Q please ask
thanks

MHM

Re: What would be the translated sources in NAT rule on Cisco FMC for

CiscoBrownBelt — Wed, 17 Jul 2024 12:34:19 GMT

Thanks! So for Out to In, Original Source and Translated Source you would enter the public IP for the public host (host out on internet want to allow reachability to server) correct? You can also just nat that host to any other internal private IP say in the same subnet as the internal private server (enter that IP/object in Translated Source field) and that would still work correct?

Re: What would be the translated sources in NAT rule on Cisco FMC for

MHM Cisco World — Wed, 17 Jul 2024 12:38:35 GMT

Yes all list below is correct

NAT = static
Source Int Obj = Outside
Desination Int Obj = Inside
Original Source = my public host IP that wants access to internal server
Original Destination = Public IP/GW for internal server
Original Services = say https
Translated Sources = my public host IP that wants access to internal server
Translated Destination = actual real private IP of internal server need access for

Apply it and dont forget add acl to allow traffic.

Goodluck friend

MHM

Re: What would be the translated sources in NAT rule on Cisco FMC for

CiscoBrownBelt — Wed, 17 Jul 2024 13:28:35 GMT

Right thanks and yes aware about rules. So for internal server host, there is already a NAT rule for the entire subnet it is on to reach internet. If entering the statement as In to Out instead, basically the FTD would know to NAT the public host when it tries to connect based on this and the specified port? Placement of this rule does not matter if there is already a NAT statement for In to Out for the entire internal subnet correct?

Also, if you leave Original Source Port/Services blank than that could be ANY? Original Destination Port and Translated Destination Port would be the port you want to use for the connection let's say just want to allow https connection? Basically how do I enter it?

Re: What would be the translated sources in NAT rule on Cisco FMC for

CiscoBrownBelt — Thu, 18 Jul 2024 18:27:11 GMT

Entered the statement as above but show xlate shows the following. Shouldn't the Inside IP (changed IP text for private purposes) be the internal host?

TCP PAT from Outside:1.1.1.1 443 to Inside:1.1.1.1 443
flags srT idle 1:08:50 timeout 0:00:00

Re: What would be the translated sources in NAT rule on Cisco FMC for

CiscoBrownBelt — Thu, 18 Jul 2024 18:30:42 GMT

I entered it in that fashion, show xlate shows the internal IP natted to public ip but the public host has the following in show xlate. Shouldn't the Inside IP (changed IP text for private purposes) be the internal host?

TCP PAT from Outside:1.1.1.1 443 to Inside:1.1.1.1 443
flags srT idle 1:08:50 timeout 0:00:00

Re: What would be the translated sources in NAT rule on Cisco FMC for

MHM Cisco World — Thu, 18 Jul 2024 18:45:03 GMT

Yes it show that
can I see the last NAT you use
thanks

MHM

Re: What would be the translated sources in NAT rule on Cisco FMC for

Marius Gunnerud — Thu, 18 Jul 2024 18:53:41 GMT

in the xlate the inside IP should be the private IP of the server, the Outside IP should be the NAT / PAT public IP.