Cisco ASA port forwarding to non direct connect host

[rodrigo-haim]

Hello, I wanted to know if Cisco ASA support a port forwarding to host who is not directly connected, and the ASA learns this host via static route.

Regards,

Rodrigo Haim

[Rob Ingram]

Hi,

Yes you can do that. You can create a NAT object and create a rule in your ACL example:-

object nat SRV1
 host 10.2.2.5
 nat (inside,outside) static 1.1.1.1 service tcp 80 80

access-list OUTSIDE_IN permit tcp any host 10.2.2.5 eq 80

As long as the ASA can route to the real IP address (in this example 10.2.2.5) then the NAT will work.

HTH

[rodrigo-haim]

Hello, thank you for the answer,

So the host 1.1.1.1 is known by static route because is not direct connected?

Do we have to configure nat for the host 1.1.1.1 to have internet access? Or is not necessary?

Regards,

Rodrigo Haim

[Rob Ingram]

In this example 1.1.1.1 is the natted IP address, it could be the actual interface of the ASA in required. You would need a route on the ASA to the real IP address (in this example 10.2.2.5) assuming it is not directly connected. This example is natting the public IP address 1.1.1.1 to the private IP address 10.2.2.5 on port 80.