topic Re: ASA Pub IP NAT in Network Security

ASA Pub IP NAT

Yahya Zyar — Wed, 17 Jul 2024 14:37:08 GMT

Hello netpros,

I want to NAT a Private IP on DMZ to a specific Public IP, we have the subnet for ex. 7.7.7.0/29 , 7.7.7.1 is the GW and .2 is assigned to the Outside interface.

I did some research and find out that i need only one Static NAT to Let the Private IP go outside with a specific Pub IP.

Lets say that we want the host 172.16.1.9 to be reachable from outside with the IP 7.7.7.3

Example :

object network ServerX
host 172.16.1.9
nat (DMZ,OUTSIDE) 7.7.7.3

So only this command will work ? i mean its just a object, can that take effect to the configuration ?

Re: ASA Pub IP NAT

MHM Cisco World — Wed, 17 Jul 2024 16:20:48 GMT

I prefer below way

Object network public

Subnrt host x.x.x.x

Object network private

Subnet host y.y.y.y

Nat (in,out) static object private objects public

You need also ACL to allow access to private IP with specific port

MHM

Re: ASA Pub IP NAT

Yahya Zyar — Thu, 18 Jul 2024 08:00:10 GMT

Thank you,

I will try that.

I have another static NAT for this private IP, can the host be reachable with two different Public IP Adresses ?

Re: ASA Pub IP NAT

MHM Cisco World — Thu, 18 Jul 2024 13:34:59 GMT

Two public IP reachable from same Outside interface

MHM

Re: ASA Pub IP NAT

Yahya Zyar — Thu, 18 Jul 2024 13:39:12 GMT

No there ist OUTSIDE1 and OUTSIDE2

OUTSIDE1 have for Ex. 7.7.7.1 /29

OUTSIDE2 6.6.6.1 /32 already nated from 172.16.1.9 host

Re: ASA Pub IP NAT

Yahya Zyar — Fri, 19 Jul 2024 10:16:27 GMT

After the confguration , sems like the Internal users cannot rach the Public IP, the IP is reachable just from Outside, can you please help

Re: ASA Pub IP NAT

MHM Cisco World — Fri, 19 Jul 2024 10:19:12 GMT

For first Q about two public IP I will check it tonight in lab

For your new reply can I see

Show nat

Show run nat

MHM

Re: ASA Pub IP NAT

Jonny Bacoz — Fri, 19 Jul 2024 11:58:18 GMT

Yes, all that is needed to NAT the private IP 172.16.1.9 on the DMZ to the particular public IP 7.7.7.3 is the one NAT declaration you gave. The command implements a static NAT translation between the outside interface and the DMZ and produces a network object for the server. Make sure the proper entries in the access control list (ACL) are in place to permit the required traffic. The NAT translation that you supplied will be enabled by the setup you mentioned.