topic That way it didn't work: in Network Security

NAT 9.4(1)

Rodrigo Fialho — Tue, 12 Mar 2019 08:14:19 GMT

Hi,

I would like to know the best way to do a NAT into ssh port:

200.X.X.X ----> 172.16.255.254 ----> 192.168.3.10

OUTSIDE DMZ INSIDE

object network 200.X.X.X
host 200.X.X.X

object network 172.16.255.254
host 172.16.255.254

object network 192.168.3.10
host 192.168.3.10

object service 22
service tcp source eq ssh

nat (any,any) source static 172.16.255.254 200.X.X.X destination static 192.168.3.10 192.168.3.10 service 22 22

Is this way correct?

At least, it's far too

Karsten Iwen — Mon, 05 Sep 2016 20:45:59 GMT

At least, it's far too complex. This is how it can work:

object network SERVER
 host 192.168.3.10
 nat (inside,outside) static 172.16.255.254 service tcp 22 22
!
access-list OUTSIDE-IN permit tcp host 200.x.x.x object SERVER eq 22

Hi Karsten,

Rodrigo Fialho — Mon, 05 Sep 2016 21:10:06 GMT

Hi Karsten,

Thank you for your answer.

But does it work withou ACL, just NAT?

Unless you haven't configured

Karsten Iwen — Mon, 05 Sep 2016 21:16:18 GMT

Unless you haven't configured something really strange, you need a matching ACL-line because you are communicating from a lower to a higher security level. That is denied by default.

That way it didn't work:

Rodrigo Fialho — Thu, 08 Sep 2016 04:00:14 GMT

That way it has not worked:

object network SERVER
 host 192.168.3.10
 nat (inside,outside) static 172.16.255.254 service tcp 22 22
!
access-list OUTSIDE-IN permit tcp host 200.x.x.x object SERVER eq 22

So it has worked!!!

object network SERVER
 host 192.168.3.10
 nat (inside,outside) static 200.x.x.x service tcp 22 22
!
access-list OUTSIDE-IN permit tcp host 200.x.x.x object SERVER eq 22