Hi,
Do you mean Static NAT or Static PAT?
Static NAT would be using a separate public IP address for each of the servers you mention. Static PAT would be forwarding ports using your ASAs "outside" interfaces public IP address.
Well just to be thorough, heres examples of both
In the below examples I presume that
- You have interfaces called "inside" and "outside" and the servers are behind "inside"
- Public IP addresses for Static NAT are 1.1.1.1 and 1.1.1.2
- You dont have any ACL created and attached to the "outside" interface so we create a new one. If you have an existing ACL then you can simply replace the name of the ACL in the below configuration.
STATIC NAT
- Separate public IP address for each server
object network STATIC-SMTP
host 10.10.10.10
nat (inside,outside) static 1.1.1.1
object network STATIC-RDP
host 10.10.10.20
nat (inside,outside) static 1.1.1.2
access-list OUTSIDE-IN remark allow SMTP and RDP to the servers
access-list OUTSIDE-IN permit tcp any object STATIC-SMTP eq smtp
access-list OUTSIDE-IN permit tcp any object STATIC-RDP eq 3389
access-group OUTSIDE-IN in interface outside
STATIC PAT
- Using the ASA "outside" interface public IP address for port server
object network STATIC-SMTP
host 10.10.10.10
nat (inside,outside) static interface service tcp smtp smtp
object network STATIC-RDP
host 10.10.10.20
nat (inside,outside) static interface service tcp 3389 3389
access-list OUTSIDE-IN remark allow SMTP and RDP to the servers
access-list OUTSIDE-IN permit tcp any object STATIC-SMTP eq smtp
access-list OUTSIDE-IN permit tcp any object STATIC-RDP eq 3389
access-group OUTSIDE-IN in interface outside
Hope this helps
Please do remember to mark the reply as the correct answer if it answered your question.
Ask more if you need clarification.
- Jouni
