Help with PAT on Cisco ASA 5520

[whiteford]

Hi,

I have a Cisco ASA 5520 and wonder if this is possible.

We have a server (172.24.10.13) on a VLAN off our 5520 that needs to connect to a SQL server (192.168.200.5) on the inside. No problem there, but I they want the VLAN server to user port 9999 instead of 1433 for SQL but want the inside SQL server to "see" the 9999 port traffic as 1433, possible?

I thought there might be a way to translate traffic sent as TCP 9999 to TCP 1433 before it his 192.168.200.5.

[Collin Clark]

Sure, it's call a port translation. Below is an example. Here we translate port 8080 on a public IP to port 80 on the inside web server.

static (inside,outside) tcp 69.222.73.5 8080 192.168.1.20 80 netmask 255.255.255.255

Hope that helps.

[whiteford]

Thanks, I guess I will just need to add an access list for this aswell? Like an allow any to 69.222.73.5 to 8080?

[Collin Clark]

Yep, you got it.

[whiteford]

hmm, still having no luck.

I added:

static (DMZ_Web_Servers,inside) tcp 192.168.200.5 1433 172.24.10.13 9877 netmask 255.255.255.255

then added an access list to allow 172.24.10.13 to 192.168.200.5 on port 9877

I then tried to telnet to "192.168.200.5 9877" and it failed.

[Collin Clark]

In your NAT statement your DMZ client is looking to 172.24.10.13 on port 9877 for SQL access. Is that correct? If so can you check your log when it fails?

[whiteford]

My DMZ client is 172.24.10.13 and needs to use TCP 9877 to the inside server 192.168.200.5 and PAT to TCP 1433

[Collin Clark]

Do you NAT between your DMZ or route?

[whiteford]

I NAT

[Collin Clark]

You'll need a new NAT address that translates to the inside. Something like this-

static (DMZ_Web_Servers,inside) tcp [new NAT IP] 9877 192.168.200.5 1433 netmask 255.255.255.255

[whiteford]

I see, so I can't use the IP of teh DMZ server I need to use this PAT and only server can use this?

[Collin Clark]

Yes, but anyone can use it, you'll restrict that with the ACL.

[whiteford]

So I can use a random IP address from from the DMZ sunbet that is not in use?

[Collin Clark]

Most people setup a special subnet just for NAT, but if you didn't then grabbing a local IP should work. However your current NAT's are setup.

[curhed]

Hi, just got curious, but shouldn't you have your static and acl statements like this?

static (inside, DMZ_Web_Servers) tcp 192.168.200.5 9877 192.168.200.5 1433 netmask 255.255.255.255

then add acl to (DMZ-int in) permit tcp host 172.24.10.13 host 192.168.200.5 eq 9877

This is just what I understood from the 1st post...