topic you are right, there is only in Network Security

nat conversion

mickyq — Tue, 12 Mar 2019 05:55:50 GMT

I need to convert the following from 8.2 nat to 9.0

static (dmz4,outside) tcp 7.3.232.220 16000 192.168.3.60 16000 netmask 255.255.255.255
static (dmz4,outside) tcp 7.3.232.220 16001 192.168.3.60 16001 netmask 255.255.255.255
static (dmz4,outside) tcp 7.3.232.220 5003 192.168.3.60 5003 netmask 255.255.255.255

I thought I needed a static PAT as follows:

object network obj-192.168.3.60

host 192.168.3.60

nat (dmz4,outside) static 7.3.232.220 service tcp 16000

nat (dmz4,outside) static 7.3.232.220 service tcp 16001

nat (dmz4,outside) static 7.3.232.220 service tcp 5003

But it seems I can only have one static int the object. Only the last nat is shown in the group.

How do I configure this?

you are right, there is only

Karsten Iwen — Wed, 13 May 2015 15:32:22 GMT

you are right, there is only one nat-statement per object.

You need to configure three objects with different names but the same host-entry. Each object will get an individual nat-entry:

object network obj-192.168.3.60-16000
  host 192.168.3.60
  nat (dmz4,outside) static 7.3.232.220 service tcp 16000 16000

object network obj-192.168.3.60-16001
  host 192.168.3.60
  nat (dmz4,outside) static 7.3.232.220 service tcp 16001 16001

object network obj-192.168.3.60-5003
  host 192.168.3.60
  nat (dmz4,outside) static 7.3.232.220 service tcp 5003 5003

The auto-nat (putting the nat

JEFF SPRADLING — Wed, 13 May 2015 15:36:50 GMT

The auto-nat (putting the nat in the object) will only allow a single nat statement. You can create the nats in the same fashion that you have them by creating separate nat statements in global config.

object network obj-192.168.3.60

host 192.168.3.60

exit

object network obj-7.3.232.220

host 7.3.232.220

exit

object service tcp16000

service tcp destination 160000

exit

object service tcp16001

service tcp destination 160001

exit

nat (dmz4,outside) source static obj-192.168.3.60 obj-7.3.232.220 service tcp16000 tcp16000

nat (dmz4,outside) source static obj-192.168.3.60 obj-7.3.232.220 service tcp16001 tcp16001

Thanks GuysI see theres two

mickyq — Thu, 14 May 2015 07:32:40 GMT

Thanks Guys

I see theres two solutions. I guess its just a case of where i want them in the nat table.

Thanks

Yes, it's more or less a

Karsten Iwen — Thu, 14 May 2015 08:06:52 GMT

Yes, it's more or less a personal preference. I always configure it the way that all "regular" NAT goes to section 2 (which is auto-NAT or object-NAT). That is also the port-forwarding that you need.

In section 1 (the manual NAT which Jeff showed you) I only configure NAT-exemption and policy NAT.

In section 3 I only have my dynamic PAT (overload) for general Internet-access.

Configuring it that way keeps the NAT-table quite readable.