topic Multiple NAT rule is possible???? in Network Security

Multiple NAT rule is possible????

vipinrajrc — Mon, 11 Mar 2019 21:23:22 GMT

Hi Experts,

Is it possible to create multiple NAT rule for a single IP? If it is Yes, in the case of exchange server how is the working?

Thanks

Vipin

Multiple NAT rule is possible????

Julio Carvajal — Mon, 12 Sep 2011 03:07:38 GMT

Hello Vipin,

Lets say that the Private ip address of the Exchange server located on the inside interface its 192.168.10.2 and the public one is 60.60.60.1

So you want to create a multiple nat rule for that server pointing to the same Public IP. one on port 25 and the other one on port 389.

So the nat rules are going to be:

Static (inside,outside) tcp 60.60.60.1 25 192.168.10.2 25

Static (inside,outside) tcp 60.60.60.1 389 192.168.10.2 389

And you can keep doing this with all the ports you need to use for this server.

I hope this help you, If you need anything else just let me know

Best Regards,

Julio

Multiple NAT rule is possible????

vipinrajrc — Mon, 12 Sep 2011 03:42:40 GMT

Hi,

Thanks for the reply...

But what about different public IPs to the same private IP???

Say public IP : 60.60.60.1, 70.60.60.2

Private : 192.168.10.2

Thanks

Vipin

Multiple NAT rule is possible????

Julio Carvajal — Mon, 12 Sep 2011 03:56:58 GMT

Hello Vipin,

Static (inside,outside) tcp 60.60.60.1 25 192.168.10.2 25

Static (inside,outside) tcp70.60.60.2 389 192.168.10.2 389

If you use port forwarding it should work but doing just a static one to one the ASA I dont thinks that is going to work because there is going to be a conflict on the configuration.

Regards.

Multiple NAT rule is possible????

Maykol Rojas — Mon, 12 Sep 2011 04:20:52 GMT

It would work, but as per Nat order it would only make outbound connections using the first one. Inbound connections will work for both 60.60.60.1 and 70.70.70.2 (Talking 8.2 and below)

Mike

Multiple NAT rule is possible????

varrao — Mon, 12 Sep 2011 04:25:42 GMT

Hi Vipin,

You would need to to use policy nat for it:

access-list abc permit ip host 192.168.10.2 any

access-list xyz permit ip host 192.168.10.2 any

static (inside,outside) 60.60.60.1 access-list abc

static (inside,outside) 70.60.60.2 access-list xyz

Let me know if this works for you.

You can usne this thread as reference:

https://supportforums.cisco.com/message/3428828#3428828

Hope this helps

Thanks,

Varun