NAT on ASA

[Hulk8647]

I need to create NAT where lets say a source from an outside IP is 33.33.33.33 to coming inside to lets say my public IP 1.1.1.1.1 which is mapped to 172.10.10.1 port 300.

So question is, how do I create nat rule saying if source IP is coming from 33.33.33.33 to map it to 1.1.1.1 (which will map it to my internal 172.10.10.1 on port 300.)

33.33.33.33 ----> http/https -----> 1.1.1.1 ------> 172.10.10.1 port 300

[mclaughlinm9]

If I'm understanding you correctly, you're saying if traffic sourced from 33.33.33.33 destined to 1.1.1.1 on port 443, then translate 1.1.1.1 to 172.10.10.1 and 443 to 300

      object network 33.33.33.33-obj
        host 33.33.33.33
      object network 1.1.1.1-obj
        host 1.1.1.1
      object network 172.10.10.1-obj
        host 172.10.10.1
      object service tcp-443
        service tcp destination eq https
      object service tcp-300
        service tcp destination eq 300
      nat (Outside,Inside) 1 source static 33.33.33.33-obj 33.33.33.33-obj destination static 1.1.1.1-obj 172.10.10.1-obj service tcp-443 tcp-300

[Hulk8647]

thank you! I'll give it a try and let you know!

[Sheraz.Salim]

as you never mentioned what port you coming in. so assuming the coming port could be any number. and other thing do have a spare public ip address on outside interface or you want to land your outside traffic on your public facing asa interface and than doing the mapping?

here is the config if you have a public ip address as you mentioned in your post.

object network SERVER
host 172.10.10.1
!
object network PUBLIC
host 1.1.1.1
!
nat (inside,outside) source static SERVER PUBLIC
!
access-list OUTSIDE_IN extended permit tcp any object SERVER eq 300
access-group OUTSIDE_IN in interface outside

[Hulk8647]

I'll be coming on on 443 and 80 which should then transalate to port 333. I have a spare IP on outside, lets say its 1.1.1.1

[Sheraz.Salim]

object network SERVER
host 172.10.10.1
!
object network PUBLIC
host 1.1.1.1
!
object service CUSTOM80
service tcp source eq 80
!
object service CUSTOM300
service tcp source eq 300
!
nat (inside,outside) source static SERVER PUBLIC service CUSTOM80 CUSTOM300
!
access-list OUTSIDE_IN extended permit tcp any object SERVER eq 80
access-group OUTSIDE_IN in interface outside
!