ASA Port forwarding

[jay_7301]

Hello,

I'm used to using Fortigate so any help would be great. When setting up a port forward for lets say from a public ip 81.176.13.2 to local of 172.30.1.1 port 80, then the same but using service port 25, i'm confused to were you define the ports because you can seem to either define it within the NAT process or within an ACL? 

would it be cleaner NOT to define the port within the NAT rule the lock the ports down within the ACL?

Thanks

[Vibhor Amrodia]

Hi,

The only reason it is recommended to use the ports with the NAT statement (Static PAT) is in the case when you have multiple internal hosts (Private addresses) that you want to make reachable from the Internet using a single Public IP.

If there is no sicu restriction , then it is recommended to use the Static NAT (one to One mapping) and then lock the ports using the ACL.

Hope that clears your query.

Thanks and Regards,

Vibhor Amrodia

[jay_7301]

Thanks so for example if i have 3 internal hosts

192.168.1.1 ( web server port 80 )

192.168.1.2 ( email server port 25 )

192.168.1.3 ( remote access 3389 )

maps to the same public ip lets say 1.1.1.1

i would have to create 3 NAT statements and define each port within the NAT statement? ( static PAT )

do i also have to add this to the ACL even though i have defined it within the NAT statement?

Thanks for for response much appreciated :)

[Vibhor Amrodia]

Hi,

Yes , in this case you would have to use the Static PAT as there are many internal devices and a single Public IP.

Also , yes you would have to create an ACL for this port to allow the traffic in addition to the NAT statement.

For ASA 8.3 +

NOTE:- I have used the Outside interface as the mapped ip for the server.

object network obj-192.168.1.1

host 192.168.1.1

nat (inside,outside) static interface service tcp 80 80

access-list Outside_in permit tcp any ip obj-192.168.1.1

access-group Outside_in interface outside

Same for the other ports.

Thanks and Regards,

Vibhor Amrodia