topic Re: PAT for any IP to a host on an ASA 5510 in Network Security

PAT for any IP to a host on an ASA 5510

Richard.Lille — Fri, 21 Feb 2020 12:11:37 GMT

Hi,

Is it possible to do a port translation for any IP to a host on an ASA 5510 ASA Version 8.0(3)

I would like to have any host trying to access a web server to be be forwarded from port 80 to 443.

But when i try to make a static NAT rule it's not possible to use any as source.

Richard.Lille — Sun, 19 Dec 2010 14:45:10 GMT

source being the Internet and destiantion a server on a dmz net.

Panos Kampanakis — Mon, 20 Dec 2010 22:33:25 GMT

You can to translate the internal dmz host right?

You can do it using policy PAT (static woith ACL) in 8.2.

access-list pat-acl permit tcp host  eq 443 any
static (dmz,outside) tcp  80 access-list pat-acl

Or manual NAT in 8.3.

I hope it helps.

Richard.Lille — Wed, 22 Dec 2010 09:17:31 GMT

I was hoping i woudn't have to change IP on the server, but i guess that would be the easiest way to solve the issue.

Thanks though 🙂

Panos Kampanakis — Wed, 22 Dec 2010 14:40:41 GMT

You can still keep the servers ip as it is (if it is a global routable ip).

access-list pat-acl permit tcp host eq 443 any

static (dmz,outside) tcp 80 access-list pat-acl

I hope it helps.