ASA Outside Interface PAT

[rohan.das]

I have a query regarding a deployment scenario.

Can i map my internal web server from inside zone to outside interface ip address in such a way that global users will hit the public ip of firewall x.x.x.x:abcd and pat will translate it to private ip y.y.y.y:cdef . ??? will it work ??

If it works please explain the procedure.

[Jon Marshall · Accepted solution]

Yes you can do this. 

The procedure varies depending on which version of software you are running but assuming you are running 8.3 or later - 

object network webserver <-- use any name you like 
host <private IP>
nat (inside,outside) static interface service tcp cdef abcd

then you need to allow access in your acl applied to the outside interface eg. 

access-list <acl name> permit tcp any <private IP> cdef

if you already have an acl applied to the outside interface add the above line to it, if you don't then you need this additional command - 

access-group <acl name> in interface outside

that should do it. 

Jon

[rohan.das]

My ASA version 9.6

and  i tried

nat (inside,outside) source static <realsource-object> interface service <cdef-service-obj> <abcd-service-obj>

am using any any acl at this moment.

but it did not work ..

any suggestion please

[rohan.das]

It worked .. I was making a mistake with my nat policy order...Thanks Jon.