topic ASA Outside Interface PAT in Network Security

ASA Outside Interface PAT

rohan.das — Tue, 12 Mar 2019 09:46:54 GMT

I have a query regarding a deployment scenario.

Can i map my internal web server from inside zone to outside interface ip address in such a way that global users will hit the public ip of firewall x.x.x.x:abcd and pat will translate it to private ip y.y.y.y:cdef . ??? will it work ??

If it works please explain the procedure.

Yes you can do this.

Jon Marshall — Sat, 05 Aug 2017 11:23:41 GMT

Yes you can do this.

The procedure varies depending on which version of software you are running but assuming you are running 8.3 or later -

object network webserver <-- use any name you like
host <private IP>
nat (inside,outside) static interface service tcp cdef abcd

then you need to allow access in your acl applied to the outside interface eg.

access-list <acl name> permit tcp any <private IP> cdef

if you already have an acl applied to the outside interface add the above line to it, if you don't then you need this additional command -

access-group <acl name> in interface outside

that should do it.

Jon

My ASA version 9.6

rohan.das — Sat, 05 Aug 2017 11:44:45 GMT

My ASA version 9.6

and i tried

nat (inside,outside) source static <realsource-object> interface service <cdef-service-obj> <abcd-service-obj>

am using any any acl at this moment.

but it did not work ..

any suggestion please

It worked .. I was making a

rohan.das — Thu, 10 Aug 2017 07:29:32 GMT

It worked .. I was making a mistake with my nat policy order...Thanks Jon.