topic Thanks a lot ! in Network Security

Static NAT vs Access-List

johan oosterwaal — Fri, 21 Feb 2020 13:42:34 GMT

Hello,

I have a question what is the best pratice for static NAT and access-list. Example:

web server(192.168.1.1) inside to outside(10.10.10.10) with port 80 and 443.

ip nat inside source static tcp 192.168.1.1 80 10.10.10.10 80

ip nat inside source static tcp 192.168.1.1 443 10.10.10.10 443

ip nat inside source static 192.168.1.1 10.10.10.10

Access-list 101 permit tcp any host 10.10.10.10 eq 80

Access-list 101 permit tcp any host 10.10.10.10 eq 443

interface ethernet0
ip access-group 101 in

Thanks

Philip D'Ath — Fri, 22 Jan 2016 22:18:56 GMT

Always use 1:1 NAT if you can over individual PAT entries. Use access-lists to control permissions rather than relying on NAT.

johan oosterwaal — Mon, 25 Jan 2016 09:20:57 GMT

hello Philip,

Thanks for the reply. Is there a security reason why you would do it like this?.

i'm just curious

Philip D'Ath — Mon, 25 Jan 2016 09:23:14 GMT

Operational reasons - it break fewer things.

johan oosterwaal — Mon, 25 Jan 2016 19:23:37 GMT

Thanks a lot !