topic Overlaping Static NAT Rule in Network Security

Overlaping Static NAT Rule

Haider Malik — Tue, 12 Mar 2019 03:31:18 GMT

Hello All . I have an issue while creating NAT rule i am having the Error Overlaping Static NAT Rule

Here is the details

I have already configured static NAT for RDP 3389 Traffic to my host 192.168.1.128 which is working fine. (so i can RDP from outside )

However now i want 9090 port to be translated to 3389 for another host 192.168.1.13 (so i can put 9090 port when i do the RDP to reach the .13 server )

i am receving the Error "

Overlaping Static NAT Rule "

I dont understand how can it be overpaped ?

(see screen shot )

Please help how can i have another Rule with PAT to the Translated port in the ASA ?

Overlaping Static NAT Rule

Haider Malik — Fri, 17 Jan 2014 12:34:22 GMT

Hello any help please ?

Overlaping Static NAT Rule

Jouni Forss — Fri, 17 Jan 2014 12:39:33 GMT

Hi,

Seems to me that you have the ports the wrong way around in the new configuration.

Your Original port is TCP/9090 which would mean that this would be the actual local port on the host. And you have set the Translated port as TCP/3389 which means that this is the public/mapped port.

Considering you have a Static PAT (Port Forward) already configure for port TCP/3389 this naturally overlaps.

So in the configuration window where you define the ports switch their places and it should be fine.

Hope this helps

- Jouni

Overlaping Static NAT Rule

Jouni Forss — Fri, 17 Jan 2014 17:05:34 GMT

Hi,

Did you get this working by changing the ports?

- Jouni

Overlaping Static NAT Rule

Haider Malik — Fri, 17 Jan 2014 17:08:57 GMT

Thank you i got your point however i have another issue for the moment

i am unable to login to the device using ASDM . i have posted

https://supportforums.cisco.com/thread/2261981?tstart=0

Overlaping Static NAT Rule

Haider Malik — Fri, 17 Jan 2014 18:47:52 GMT

can you let me kow if this below correct meanwhile i cant get the ASDM access .

access-list 100 extended permit tcp any any eq 9090

static (inside,outside) tcp interface 9090 192.168.1.13 3389 netmask 255.255.255.255

access-list outside_access_in extended permit tcp any interface outside eq 9090