NAT 9.4(1)

[Rodrigo Fialho]

Hi,

I would like to know the best way to do a NAT into ssh port:

200.X.X.X ----> 172.16.255.254 ----> 192.168.3.10

OUTSIDE                    DMZ                     INSIDE

object network 200.X.X.X
 host 200.X.X.X

object network 172.16.255.254
 host 172.16.255.254

object network 192.168.3.10
 host 192.168.3.10

object service 22
 service tcp source eq ssh

nat (any,any) source static 172.16.255.254 200.X.X.X destination static 192.168.3.10 192.168.3.10 service 22 22

Is this way correct?

[Karsten Iwen]

At least, it's far too complex. This is how it can work:

object network SERVER
 host 192.168.3.10
 nat (inside,outside) static 172.16.255.254 service tcp 22 22
!
access-list OUTSIDE-IN permit tcp host 200.x.x.x object SERVER eq 22

[Rodrigo Fialho]

Hi Karsten,

Thank you for your answer.

But does it work withou ACL, just NAT?

[Karsten Iwen]

Unless you haven't configured something really strange, you need a matching ACL-line because you are communicating from a lower to a higher security level. That is denied by default.

[Rodrigo Fialho]

That way it has not worked:

object network SERVER
 host 192.168.3.10
 nat (inside,outside) static 172.16.255.254 service tcp 22 22
!
access-list OUTSIDE-IN permit tcp host 200.x.x.x object SERVER eq 22

So it has worked!!!

object network SERVER
 host 192.168.3.10
 nat (inside,outside) static 200.x.x.x service tcp 22 22
!
access-list OUTSIDE-IN permit tcp host 200.x.x.x object SERVER eq 22