topic Static Natting of Public IP in Network Security

Static Natting of Public IP

vinayak — Mon, 11 Mar 2019 19:39:38 GMT

Dear All,

Currently in my office i am having Cisco ASA 5510. I done port forwarding on ASA & using my public IP for accessing my Citrix Application from anywhere on internet.

Now i am having another Web Based application which i want to access as same as citrix application. But when i am going to add static nat it gives error as "Static Nat to this ip is exist."

How can i assign different ip to my application ?

Re: Static Natting of Public IP

Jennifer Halim — Tue, 25 Jan 2011 06:50:15 GMT

You can't use the same public ip address twice for NATing unless you are using static port address redirection and use different port for the translation.

Do you have a spare public ip address?

If you don't, are you using the same port for the citrix gateway as well as the web based application? If you don't, then you can configure static PAT and use the same public IP, but if you are using the same port, then you can't use static PAT.

Re: Static Natting of Public IP

vinayak — Tue, 25 Jan 2011 06:59:38 GMT

Dear Jennifer,

We dont have spare public ip's.

Can you please tell me how we can enable Static PAT ?

Here are the current config. of static NAT :

static (inside,outside) tcp interface www server www netmask 255.255.255.255
static (inside,outside) tcp interface citrix-ica server citrix-ica netmask 255.255.255.255
static (inside,outside) tcp interface 2598 server 2598 netmask 255.255.255.255

Thanks.

Re: Static Natting of Public IP

vinayak — Tue, 25 Jan 2011 07:01:47 GMT

Dear Jennifer,

We dont have spare public IP's.

For citrix we have different port (2598) & for new application we have Different Port (37777)

Here is static config :

Can you please tell me how to Enable Static PAT ?

Re: Static Natting of Public IP

Jennifer Halim — Tue, 25 Jan 2011 07:05:35 GMT

Then you can configure the following for the new application access:

static (inside,outside) tcp interface 37777 37777 netmask 255.255.255.255

Then you will also need to configure the outside ACL to allow traffic on port 37777.

Re: Static Natting of Public IP

vinayak — Tue, 25 Jan 2011 07:09:48 GMT

Dear Jennifer,

When i put the command the result is as below :

Result of the command: "static (inside,outside) tcp interface 37777 192.168.0.199 37777 netmask 255.255.255.255"

ERROR: mapped-address conflict with existing static
inside:server to outside:121.242.223.102 netmask 255.255.255.255
Usage: [no] static [(real_ifc, mapped_ifc)]
{|interface}
{ [netmask ]} | {access-list }
[dns]
[[tcp] [ [ [nailed]]]]
[udp ]
[no] static [(real_ifc, mapped_ifc)] {tcp|udp}
{|interface}
{ [netmask ]} |
{access-list }
[dns]
[[tcp] [ [ [nailed]]]]
[udp ]
show running-config [all] static []
clear configure static

Re: Static Natting of Public IP

lal.antony — Tue, 25 Jan 2011 07:12:37 GMT

@Vinayak

Below Cisco article will be useful in understanding NAT/PAT properly.

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a008046f31a.shtml

Also I have a simple descriptive examples in my blog that will assist you in getting your issue sorted.

Cisco ASA NAT and PAT Configuration Permanent link http://lalantony.me/?p=46

If you still having issues please don't hesitate to drop me a line.

Cheers

www.lalantony.com

Re: Static Natting of Public IP

Jennifer Halim — Tue, 25 Jan 2011 07:16:27 GMT

Can you please share the output of "show run static"? It's probably already configured, hence you won't be able to re-add it.

Re: Static Natting of Public IP

vinayak — Tue, 25 Jan 2011 07:23:15 GMT

Dear Jennifer,

As i said earlier i already configured Static Nat for Citrix Application.

Here is the config. commands :

Now i want to use this public IP to other Application also. I dont have spare public IP.

Re: Static Natting of Public IP

Jennifer Halim — Tue, 25 Jan 2011 07:40:44 GMT

That is not a problem as long as you are not using the same port.

Currently you have used the following port for your citrix:

port 80 (www)

port 1494

port 2598

So if you are trying to add port 37777, that is fine, you can use the same public ip address.

However, you can't use any of the above same port for the new web application static PAT.

Re: Static Natting of Public IP

vinayak — Tue, 25 Jan 2011 08:12:50 GMT

Dear Jennifer,

I successfully added static PAT in firewall. But still i am not able to open 121.242.223.102:37777 from outside internet.

if i am tring to put www it gives error as it already assigned for citrix.

then which port should i use for accessing 121.242.223.102:37777 from outside internet..

Re: Static Natting of Public IP

Jennifer Halim — Tue, 25 Jan 2011 08:37:40 GMT

Have you added access-list on the outside interface to allow traffic towards port 37777?

Is the web application listening on port 37777?