ASA NAT rules question

[Tejas Kunte]

i have an ASA 5520 8.4(1) with following config

interface GigabitEthernet0/0

nameif WAN

security-level 0

ip address 216.52.185.33 255.255.255.240 standby 216.52.185.34

!

interface GigabitEthernet0/1

nameif DMZ

security-level 50

ip address 216.52.185.49 255.255.255.240 standby 216.52.185.50

!

interface GigabitEthernet0/2

nameif Production

security-level 100

ip address 10.11.27.11 255.255.255.0 standby 10.11.27.12

i need traffic (port 9350) from DMZ and WAN forwarded to object Production_23 port 3389

how do i achieve this ?

if i try to do the below config, it gets overwritten.i can either specify the WAN rule or DMZ rule not both

object network PROD_23

nat (Production,WAN) static WAN_35 service tcp 3389 9350

nat (Production,DMZ) static DMZ_54 service tcp 3389 9350

i have the necessary ACLs in place.

[varrao]

Hi Tejas,

You woudl not be able to do it. You can only define one nat statement under one object, doing multiple would replace the previous one. If you have to add another nat statement, you would need to do this:

object network PROD_23

nat (Production,WAN) static WAN_35 service tcp 3389 9350

object network PROD_23_second

  host xx.xx.xx.xx

  nat (Production,DMZ) static DMZ_54 service tcp 3389 9350

Then only it would work.

Hope this helps.

Thanks,

Varun