ASA 5545 object nat

[yvonne-tsara]

Good day

May you please assist me. I have a scenario were on object nat has been created on ASA 5545 using one public ip for 2 different private ips with different port. Only one instance is working is working while the other one isnt.

I have also tried using static nats but when one works the other one doesn't.  How best can I handle this? Below is my configuration.

object network TEST_DMZ_ORIGINAL_8291
host 10.10.11.8
object network LIVE_DMZ_ORIGINAL_8290
host 10.10.11.7
object network TEST_DMZ_ORIGINAL_8291
nat (dmz,outside) static PUBLIC service tcp 8291 8291
object network LIVE_DMZ_ORIGINAL_8290
nat (dmz,outside) static PUBLIC service tcp 8290 8290

[MHM Cisco World]

ASA(config)# nat (dmz,outside) 1 source static 
TEST_DMZ_ORIGINAL_8291 <interface or public IP object network name> service tcp 8290 8290  

 Above is correct, remove auto NAT you use before.

MHM

[yvonne-tsara]

I am not sure if I have an auto nat configured. All the static nats I had initially configured, I removed them but the object nat is only working for one server.

[MHM Cisco World]

ASA(config)# nat (dmz,outside) 1 source static 
TEST_DMZ_ORIGINAL_8291 <interface or public IP object network name> service tcp 8291 8291

ASA(config)# nat (dmz,outside) 1 source static 
LIVE_DMZ_ORIGINAL_8290 <interface or public IP object network name> service tcp 8290 8290

Add above 

And remove 

TEST_DMZ_ORIGINAL_8291
nat (dmz,outside) static PUBLIC service tcp 8291 8291
object network LIVE_DMZ_ORIGINAL_8290
nat (dmz,outside) static PUBLIC service tcp 8290 8290

MHM

[yvonne-tsara]

Thank you, let me try that.

[MHM Cisco World]

Sure take your time

MHM

[yvonne-tsara]

After the service command, i only have 2 options shown below.

configure mode commands/options:
WORD Specify object name for real service
any All service objects

My IOS version is shown below:

Cisco Adaptive Security Appliance Software Version 9.12(4)30
SSP Operating System Version 2.6(1.232)
Device Manager Version 7.17(1)152

[MHM Cisco World]

object service 8290
 service tcp source eq 8290

object service 8291
 service tcp source eq 8291

Use object service as above in NAT command.

MHM

[yvonne-tsara]

Thank you so much. It is working now. What makes the object nat and the ordinary static nat fail to work.

[MHM Cisco World]

Order' 

Auto NAT (object NAT) come in order and if you use have dyanimc NAT above these server static auto NAT then the traffic will hit wrong NAT.

So we use manual NAT because these NAT always be in top list of NAT config in ASA and after it come other object NAT.

MHM

[yvonne-tsara]

Thanks a million

[MHM Cisco World]

You  are welcome billion