topic ASA 5510 - How to use outside NAT, Traffic from internal adress using different wan adress for a specific port in Network Security

ASA 5510 - How to use outside NAT, Traffic from internal adress using different wan adress for a specific port

Wouter Platteeuw — Tue, 12 Mar 2019 06:09:25 GMT

Hey all,

This is the situation:

(the shown ip adresses are fictional)

We have a server with the internal IP Adress of 10.1.100.2. Our public Adres is 214.214.214.214. We also have a public adress of 214.214.214.215.

This server needs to send traffic over port 8555 and use 214.214.214.215 as the sending adress for the destination firewall to accept the packets.

I have created a NAT rule (using the graphical user interface) but i am not sure if the rule is correct as we still receive timeouts when trying to send out the packet. When making a nat rule using the gui by default does it create only an inside nat rule or both inside and outside?

(what i did is i went to NAT rules and clicked on add "Network Obect" Nat rule. Name Server, Type Host, IP 10.1.100.2 NAT type Static -> Translated addr: 214.214.214.215 and on advanced i mapped service 8555 to it)

Is this correct?

Can anyone supply me the command line command? (for the future and just in case)

Thanks in advance

Hi,I think if i understand it

Vibhor Amrodia — Fri, 19 Jun 2015 11:06:09 GMT

Hi,

I think if i understand it correctly , your requirement is to NAT Private server to .215 IP address over port 8555 to the destination.

If this is the case , Static PAT for 8555 port would not work as the outbound traffic would not use this Static PAT and instead use the Dynamic NAT configured on the ASA device.

To make this work , use Static NAT instead:-

object network obj-10.1.100.2

host 10.1.100.2

nat (inside,outside) static 214.214.214.215

Thanks and Regards,

Vibhor Amrodia

Well i did make a static nat

Wouter Platteeuw — Tue, 23 Jun 2015 14:47:38 GMT

Well i did make a static nat rule (using the gui)

I did a packet trace and it says 10.1.100.2/8555 translate to 214.214.214.215/8555

so i guess the problem doesnt lie on my end. i will call them tomorrow.

(Btw i tryed the nat (inside,outside) command but it didnt recognize it version 8.4(2) adsm 6.4 (5))