topic Re: Static nat when you have only one outside addr question in Network Security

Static nat when you have only one outside addr question

john.wright — Tue, 12 Mar 2019 02:03:28 GMT

We have a remote site that has a 5505 ios 8.3.1.

We have a /30 outside addr range so we only have 2 outside addr available; the addr of the outside interface + the gateway.

We need to allow a vendor to access an inside addr.

Will the following config work in order to allow access?

(config)# object network voice_gateway

(config-network-object)# host 10.10.10.10

(config-network-object)# nat (inside,outside) static 109.109.109.109 service tcp ssh ssh

109.109.109.109 is the addr of the outside interface

object-group network vendor

network-object 8.9.9.9 255.255.255.224

access-list acl_outside extended permit tcp object-group vendor 109.109.109.109 255.255.255.252 eq ssh

Re: Static nat when you have only one outside addr question

malshbou — Wed, 26 Jun 2013 17:36:30 GMT

Hi John,

You only need to fix the access-list so that it points to the private IP instead of the public IP, because your version is 8.3. This config will work for enabling inbound SSH access to your internal server, however, you should pay attention that if the natted public IP is the same as your outside interface IP, then SSH access to the ASA from the outside will not be possible, because all traffic hitting outside IP at port 22 will be redirected to the inside.

Hope this helps

---------
Mashal Alshboul

Re: Static nat when you have only one outside addr question

john.wright — Wed, 26 Jun 2013 18:24:01 GMT

Mashal

Thanks for the response. I was not sure about the acl so thanks for clearing that up.

And I understand what you are saying about the ssh.

Is there another way of doing the ssh access?

Static nat when you have only one outside addr question

malshbou — Wed, 26 Jun 2013 18:38:38 GMT

Hi John,

You cannot change the default SSH port in ASA. Instead, I suggest that you change the natted port to be any port other than 22 so that you get SSH access to both ASA and internal server.

for example:

(config-network-object)# nat (inside,outside) static 109.109.109.109 service tcp ssh 222

Hope this answers your questions.

---------
Mashal Alshboul

Static nat when you have only one outside addr question

john.wright — Thu, 27 Jun 2013 14:43:58 GMT

Mashal

here is what I got when I tried to set this up.

ERROR: Address 109.109.109.109 overlaps with outside interface address.

ERROR: NAT Policy is not downloaded

Static nat when you have only one outside addr question

malshbou — Thu, 27 Jun 2013 21:39:57 GMT

John

Use the keyword "interface" instead of the IP.

---
Mashal Alshboul

Static nat when you have only one outside addr question

john.wright — Fri, 28 Jun 2013 14:41:52 GMT

Mashal

Thanks, that worked!