topic NAT one-to-one on ASA in Network Security

NAT one-to-one on ASA

fabflorent — Tue, 12 Mar 2019 09:43:19 GMT

Hello,

I have a Cisco ASA on my network edge. I have INSIDE, DMZ and OUTSIDE.

There is a PAT rule for inside LAN users:

nat (inside,outside) source dynamic Users_LAN interface

Now I have installed a Web server in DMZ and I have a second public address I want to dedicate to the web server.

How can I configure a one-to-one NAT between the private and the public address of the server?

Note: I do not have access to ASDM and I am using CLI.

Aditya Ganjoo — Fri, 21 Jul 2017 08:28:38 GMT

Hi,

You can use the following NAT:

ASA (config) #object network obj-real-IP

host 10.x.x.x

nat (inside,outside) static <public IP>

You would require an Access list on the outside interface to allow traffic for the DMZ server.

Regards,

Aditya

Please rate helpful and mark correct answers

fabflorent — Fri, 21 Jul 2017 09:29:53 GMT

Thank you Aditya,

But it does not work.

My Web server still have no access to outside internet

Aditya Ganjoo — Fri, 21 Jul 2017 09:32:32 GMT

Hi,

Please share the output of packet tracer from the ASA.

Regards,

Aditya

Please rate helpful and mark correct answers