topic Re: NAT on ASA in Network Security

NAT on ASA

Hulk8647 — Fri, 21 Feb 2020 16:52:14 GMT

I need to create NAT where lets say a source from an outside IP is 33.33.33.33 to coming inside to lets say my public IP 1.1.1.1.1 which is mapped to 172.10.10.1 port 300.

So question is, how do I create nat rule saying if source IP is coming from 33.33.33.33 to map it to 1.1.1.1 (which will map it to my internal 172.10.10.1 on port 300.)

33.33.33.33 ----> http/https -----> 1.1.1.1 ------> 172.10.10.1 port 300

Re: NAT on ASA

mclaughlinm9 — Tue, 26 Feb 2019 19:27:30 GMT

If I'm understanding you correctly, you're saying if traffic sourced from 33.33.33.33 destined to 1.1.1.1 on port 443, then translate 1.1.1.1 to 172.10.10.1 and 443 to 300

      object network 33.33.33.33-obj
        host 33.33.33.33
      object network 1.1.1.1-obj
        host 1.1.1.1
      object network 172.10.10.1-obj
        host 172.10.10.1
      object service tcp-443
        service tcp destination eq https
      object service tcp-300
        service tcp destination eq 300
      nat (Outside,Inside) 1 source static 33.33.33.33-obj 33.33.33.33-obj destination static 1.1.1.1-obj 172.10.10.1-obj service tcp-443 tcp-300

Re: NAT on ASA

Hulk8647 — Tue, 26 Feb 2019 19:51:49 GMT

thank you! I'll give it a try and let you know!

Re: NAT on ASA

Sheraz.Salim — Tue, 26 Feb 2019 21:16:50 GMT

as you never mentioned what port you coming in. so assuming the coming port could be any number. and other thing do have a spare public ip address on outside interface or you want to land your outside traffic on your public facing asa interface and than doing the mapping?

here is the config if you have a public ip address as you mentioned in your post.

object network SERVER
host 172.10.10.1
!
object network PUBLIC
host 1.1.1.1
!
nat (inside,outside) source static SERVER PUBLIC
!
access-list OUTSIDE_IN extended permit tcp any object SERVER eq 300
access-group OUTSIDE_IN in interface outside

Re: NAT on ASA

Hulk8647 — Wed, 27 Feb 2019 16:40:47 GMT

I'll be coming on on 443 and 80 which should then transalate to port 333. I have a spare IP on outside, lets say its 1.1.1.1

Re: NAT on ASA

Sheraz.Salim — Wed, 27 Feb 2019 19:56:38 GMT

object network SERVER
host 172.10.10.1
!
object network PUBLIC
host 1.1.1.1
!
object service CUSTOM80
service tcp source eq 80
!
object service CUSTOM300
service tcp source eq 300
!
nat (inside,outside) source static SERVER PUBLIC service CUSTOM80 CUSTOM300
!
access-list OUTSIDE_IN extended permit tcp any object SERVER eq 80
access-group OUTSIDE_IN in interface outside
!