PAT Question - For Inbound and Outbound

Thiago Cella — Tue, 12 Mar 2019 05:10:37 GMT

Hi Friends,

Is it possible to user one address, for a PAT , to my inside Network go to Internet, and this same address to use a inbound access from Internet, for example on port 3389?

For example, supose my inside is 192.168.1.0/24, and my outside is 1.1.1.1/30. So my inside using the IP 1.1.1.1 to access the Internet.

Is it possible to use this IP 1.1.1.1 to conection from Internet to port 3389 to access to my internal server 192.168.1.10 ?

If is possible, could send a example of this on ASA ?

Tks

Hi, Yes its possible and were

Jouni Forss — Thu, 04 Dec 2014 11:08:42 GMT

Hi,

Yes its possible and were common configuration on the ASA.

You have not mentioned your ASAs software level which decides the NAT configurations format. The NAT configuration format changed between 8.2 -> 8.3 software update.

In 8.2 (or below) the typical Dynamic PAT and Static PAT configuration would be like this

global (outside) 1 interface

nat (inside) 1 192.168.1.0 255.255.255.0

static (inside,outside) tcp interface 3389 192.168.1.10 3389 netmask 255.255.255.255

And you would have to allow connections to your IP address 1.1.1.1 on port TCP/3389 in the external interfaces ACL.

In 8.3 (or above) the typical Dynamic PAT and Static PAT configuration would be like this

nat (inside,outside) after-auto source dynamic any interface

object network STATIC-PAT
host 192.168.1.10
nat (inside,outside) static interface service tcp 3389 3389

In the external interfaces ACL you would have to allow connections to IP address 192.168.1.10 and to the real port TCP/3389

Hope this helps 🙂

- Jouni

topic Hi, Yes its possible and were in Network Security

PAT Question - For Inbound and Outbound

Hi, Yes its possible and were