topic Re: outside NAT in Network Security

outside NAT

donnie — Mon, 11 Mar 2019 18:01:00 GMT

Hi all,

How do i configure outside NAT such that my external public ip is map to one of my dmz private ip.

What i want is when any address on the internet connects to my public ip on a certain port it will translate to my dmz ip which my server is using.

I am using asdm to configure my cisco asa 5510 firewall. I did a NAT for my source public ip to be translated to my dmz ip. I then set an accesslist to allow any incoming ip on a specific port to access the public ip i configure for outside NAT. But it didnt work. Pls advise. Thks in advance.

Re: outside NAT

Jennifer Halim — Fri, 18 Jun 2010 12:31:13 GMT

With CLI:

static (DMZ,outside) netmask 255.255.255.255

With ASDM:

Configuration --> Firewall --> NAT Rules --> Add Static NAT rule -->

Original interface: DMZ

Source: dmz-private-ip

Translated interface: outside

Use IP Address: external-public-ip

Then click: OK, and apply.

Access-list applied on the outside interface should allow traffic from "any" towards the external public ip on certain tcp/udp ports.

Hope that helps.

Re: outside NAT

donnie — Sun, 20 Jun 2010 05:13:36 GMT

Hi Halijenn,

Thk you for your prompt response. I know of the steps required for NAT stated in your reply. What i am looking for is when any internet ip access my public ip eg 203.x.x.10 and 203.x.x.11 it will automatically translate to my 1 private ip eg 192.168.10.1. We use to have 2 private ip(192.168.10.1, 192.168.10.2) translate to the 2 public ip stated above, but we have merge the 2 servers into 1.

We would like to continue to use the 2 public ip so that it is a transparent transition for our external customers. Thks in advance.

Re: outside NAT

gatlin007 — Sun, 20 Jun 2010 15:40:04 GMT

Don,

I'm not sure if this approach is supported but I've used something like this in the past when migrating external addresses; proceed at your own risk.

access-list tango permit ip any host 192.168.10.1 any

static (dmz,outside) 203.x.x.10 192.168.10.1
static (dmz,outside) 203.x.x.11 access-list tango

Chris

Re: outside NAT

Jennifer Halim — Mon, 21 Jun 2010 01:42:17 GMT

Unfortunately you can't translate 2 public ip addresses to just 1 private ip address as it is not supported.