ASA Pub IP NAT

[Yahya Zyar]

Hello netpros,

I want to NAT a Private IP on DMZ to a specific Public IP, we have the subnet for ex. 7.7.7.0/29 , 7.7.7.1 is the GW and .2 is assigned to the Outside interface.

I did some research and find out that i need only one Static NAT to Let the Private IP go outside with a specific Pub IP.

Lets say that we want the host 172.16.1.9 to be reachable from outside with the IP 7.7.7.3

Example :

object network ServerX
host 172.16.1.9
nat (DMZ,OUTSIDE) 7.7.7.3

So only this command will work ? i mean its just a object, can that take effect to the configuration ?

[MHM Cisco World]

I prefer below way

Object network public

Subnrt host x.x.x.x

!

Object network private 

Subnet host y.y.y.y

!

Nat (in,out) static object private objects public 

You need also ACL to allow access to private IP with specific port

MHM

[Yahya Zyar]

Thank you,

I will try that.

I have another static NAT for this private IP, can the host be reachable with two different Public IP Adresses ?

[MHM Cisco World]

Two public IP reachable from same Outside interface 

MHM

[Yahya Zyar]

No there ist OUTSIDE1 and OUTSIDE2 

OUTSIDE1 have for Ex. 7.7.7.1 /29

OUTSIDE2 6.6.6.1 /32 already nated from 172.16.1.9 host

[Yahya Zyar]

After the confguration , sems like the Internal users cannot rach the Public IP, the IP is reachable just from Outside, can you please help

[MHM Cisco World]

Hi 

For first Q about two public IP I will check it tonight in lab

For your new reply can I see 

Show nat 

Show run nat 

MHM

[Jonny Bacoz]

Yes, all that is needed to NAT the private IP 172.16.1.9 on the DMZ to the particular public IP 7.7.7.3 is the one NAT declaration you gave. The command implements a static NAT translation between the outside interface and the DMZ and produces a network object for the server. Make sure the proper entries in the access control list (ACL) are in place to permit the required traffic. The NAT translation that you supplied will be enabled by the setup you mentioned.