topic Dynamic and Static PAT using a single public IP in Network Security

Dynamic and Static PAT using a single public IP

stevenilan — Tue, 12 Mar 2019 04:15:22 GMT

Hi,

I'm trying to configure PAT on a new ASA-5510 running 9.0(3) and I'm having some issues.

In our setup we have a single public IP address(lets say 127.1.1.1) which is assigned to the outside interface, and we need to use that for both dynamic PAT to allow all machines in our 10.1.0.0 255.255.255.0 subnet hit the outside world, as well as allow the outside world FTP access to (10.1.0.124) on the inside using static PAT.

I have dynamic PAT working and we are able to hit the outside world, but I can't get the static service PAT working to forward FTP traffic.

The configuration looks like this right now:

object network obj-10.1.0.124
host 10.1.0.124

object network obj-10.1.0.0
subnet 10.1.0.0 255.255.255.0

nat (infra,outside) source dynamic obj-10.1.0.0 interface

!
object network obj-10.1.0.124
nat (infra,outside) static interface service tcp 21 21

Should the dynamic PAT rule also be written as a network object rule?

Thanks!

Steve

That looks correct, just add

manish arora — Wed, 28 May 2014 19:06:55 GMT

That looks correct, just add another static PAT for TCP port 20 as well.

Here's a link to a useful Doc :

https://supportforums.cisco.com/document/33921/asa-pre-83-83-nat-configuration-examples

Manish

Thanks for your reply. It

stevenilan — Wed, 28 May 2014 20:58:04 GMT

Thanks for your reply. It isn't working though so I'm not sure what the problem is, adding another PAT translation for port 20 did not help either.

Please post the output of the

manish arora — Wed, 28 May 2014 21:00:56 GMT

Please post the output of the following :

show nat detail

show run nat

Manish

Changing the global PAT to an

stevenilan — Thu, 29 May 2014 14:26:53 GMT

Changing the global PAT to an object PAT rule got everything working correctly.

object network obj-10.1.0.0
subnet 10.1.0.0 255.255.255.0

object network obj-ftp-access
host 10.1.0.124

object network obj-10.1.0.0
nat (infra,outside) dynamic interface

object network obj-ftp-access
nat (infra,outside) static interface service tcp 21 21

Thanks for your help Manish,

stevenilan — Thu, 29 May 2014 14:27:29 GMT

Thanks for your help Manish, I figured it out.

-Steve