Multiple WAN IP addresses NAT inbound

[benford01]

All 

This is my first time configuring a ASA and im facing some issues. It seems like im trying to do something basic but i cannot get it to work how i expect. 

I have multiple public IP addresses say /29 and im trying to assign them to an interface. Where normally i would assign one address to the interface and have the rest as additional addresses but im struggling to see how i do this on the ASA.

When i try set up a outside - Inside NAT rule using the additional address i have added it says the subnets overlap. 

Any help would be much appreciated.

Ben 

[Rishabh Seth]

Hi Ben,

You can assign only one IP on the ASA interface from a subnet. In case you are using other IP addresses in the subnet to map some internal machines then you can can create NAT statements on ASA.

Please share more details about your setup and let us know what version of ASA software are you using?

Thanks,

R.Seth

[benford01]

Hi R

Im using 9.4.2. 

This is what im trying to do. I have a subnet of /29. I have multiple services that i need to reach from the outside world that are inside. I have done a table below of how would like it to work. 

destination address	port	internal address	port
77.88.99.15	9100	10.10.10.1	9100
77.88.99.16	9100	10.10.10.2	9100
77.88.99.17	9100	10.10.10.3	9100

Does this help you understand ?

Ben 

[Rishabh Seth · Accepted solution]

Hi Ben,

You can create STATIC NAT on ASA to map a public IP to private IP on a particular port. Once you create NAT you will also require acl to permit traffic for real IP addresses.

Eg:

object network 77.88.99.15
 host 77.88.99.15
object network 10.10.10.1
 host 10.10.10.1

object network 10.10.10.1
 nat (inside,outside) static 77.88.99.15 service tcp 9100 9100

Note: if you are mapping the public IP which is configured on the interface of ASA then use keyword "interface" instead of IP address in your nat statement.

Hope it helps!!!

Thanks,

R.Seth

Don't forget to mark the answer as correct if it helps in resolving your query!!!

[benford01]

Would this not be natting on the way from inside to outside ? 

[Rishabh Seth]

Hi Ben,

static NAT is bidirectional, so it will take care of in to out and out to in traffic.

Thanks,

R.Seth

[benford01]

Thanks Rishabh, I will give that a go.!

Ben