cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

Welcome to Cisco Firewalls Community


236
Views
5
Helpful
2
Replies
Highlighted
Beginner

ASA NAT for DMZ Public IP

Hi,

I have two DMZ on an ASA running 9.9 which use separate public IP to the LAN, and this all works fine, traffic from DMZ2 (10.3.3.0/24) is NAT'd to 1.1.1.4 etc - see attached diagram. What I'm having problems with is I now need to forward inbound traffic to 1.1.1.4 on tcp ports 80 & 443 to the server in DMZ2 (10.3.3.2), and the nat syntax for this is not accepting the commands I have used (I think!?!) in the past on ASA 8.4, which is the last two line in red.


Config snippet below:

object network obj-dmz1-wan
 host 1.1.1.3
object network obj-dmz1-lan
 subnet 10.2.2.0 255.255.255.0
 nat (dmz1,outside) dynamic obj-dmz1-wan

object network obj-dmz2-wan
 host 1.1.1.4
object network obj-dmz2-lan
 subnet 10.3.3.0 255.255.255.0
 nat (dmz2,outside) dynamic obj-dmz2-wan

object network obj-dmz2-server
 host 10.3.3.2
 nat (dmz2,outside) static 1.1.1.4 service tcp 80 80
 nat (dmz2,outside) static 1.1.1.4 service tcp 443 443

 

 

I have tried adding in a service object-group, but again the NAT syntax isn't as clear as I though:

object-group service obj-dmz2-ports
 service-object tcp destination eq 80
 service-object tcp destination eq 443

nat (dmz2,outside) source static obj-dmz2-wan interface service obj-dmz2-ports

 

Can someone help untangle this NAT syntax or link to guide, as I have been googling Cisco docs and searching forums for ages, and I just cannot see though what I'm doing wrong or find a config example!

Thanks.

 

Everyone's tags (4)
1 ACCEPTED SOLUTION

Accepted Solutions
VIP Advisor

Re: ASA NAT for DMZ Public IP

Remove this

object network obj-dmz2-lan
subnet 10.3.3.0 255.255.255.0
nat (dmz2,outside) dynamic obj-dmz2-wan

Add this

object network obj-dmz2-server
host 10.3.3.2
nat (dmz2,outside) static 1.1.1.4 service tcp 80 80
nat (dmz2,outside) static 1.1.1.4 service tcp 443 443
Then add this again

object network obj-dmz2-lan
subnet 10.3.3.0 255.255.255.0
nat (dmz2,outside) dynamic obj-dmz2-wan

View solution in original post

2 REPLIES 2
VIP Advisor

Re: ASA NAT for DMZ Public IP

Remove this

object network obj-dmz2-lan
subnet 10.3.3.0 255.255.255.0
nat (dmz2,outside) dynamic obj-dmz2-wan

Add this

object network obj-dmz2-server
host 10.3.3.2
nat (dmz2,outside) static 1.1.1.4 service tcp 80 80
nat (dmz2,outside) static 1.1.1.4 service tcp 443 443
Then add this again

object network obj-dmz2-lan
subnet 10.3.3.0 255.255.255.0
nat (dmz2,outside) dynamic obj-dmz2-wan

View solution in original post

Beginner

Re: ASA NAT for DMZ Public IP

Yes, that was it, the order of the NAT statements being applied. Thank you!