topic Many thanks Jon in Network Security

static nat for server in ASA 8.6

mahesh18 — Tue, 12 Mar 2019 06:46:59 GMT

Hi Everyone,

We have server with public IP and users from outside internet need access to it.
On firewall outside interface i config the ACL to allow access to server on certain ports.

For traffic back from the server i need to config the NAT
Outside interface of firewall has public IP.

NAT config i need to verify here

object network obj-192.168.100.0
subnet 192.168.100.0 255.255.255.0
object network obj-192.168.100.33
host 192.168.100.33

interface GigabitEthernet0/1
no shutdown
nameif inside
security-level 100
ip address 192.168.100.25 255.255.255.0

object network obj-192.168.100.0
nat (inside,outside) dynamic interface

object network obj-192.168.100.33
nat (inside,outside) static 131.x.x.x

Regards
Mahesh

Hi Mahesh,You configuration

Akshay Rastogi — Wed, 21 Oct 2015 17:59:20 GMT

Hi Mahesh,

You configuration is correct.

You static nat statement would take care of bidirectional traffic(return traffic would be handled by the xlate entry formed by this static nat). You dynamic nat would help providing the internet access to your 192.168.100.0 subnet.

As you are using post 8.3 version, you need to configure private address(192.168.100.33) as destination in outside ACL as post 8.3 version uses Real IP for allowing traffic on outside.

Mark the answer as correct if it answers your queries.

Regards,

Akshay Rastogi

So for traffic to server from

mahesh18 — Wed, 21 Oct 2015 18:58:39 GMT

So for traffic to server from outside I am using real ip on ACL on outside interface.

Is this correct?

Regards

Mahesh

Yes that is correct.Jon

Jon Marshall — Wed, 21 Oct 2015 20:16:25 GMT

Yes that is correct.

Jon

Hi Mahesh,Yes. It is new way

Akshay Rastogi — Thu, 22 Oct 2015 03:31:55 GMT

Hi Mahesh,

Yes. It is new way it is configured in versions post 8.3. You could go through the link below to understand the changes done from version pre 8.3 to post 8.3 :

http://www.cisco.com/c/en/us/td/docs/security/asa/asa83/upgrading/migrating.html

Regards,

Akshay Rastogi

Many thanks Jon

mahesh18 — Mon, 26 Oct 2015 14:55:12 GMT

Many thanks Jon