cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

559
Views
0
Helpful
5
Replies
Highlighted
Beginner

NAT on ASA

I need to create NAT where lets say a source from an outside IP is 33.33.33.33 to coming inside to lets say my public IP 1.1.1.1.1 which is mapped to 172.10.10.1 port 300.

So question is, how do I create nat rule saying if source IP is coming from 33.33.33.33 to map it to 1.1.1.1 (which will map it to my internal 172.10.10.1 on port 300.)

 

33.33.33.33 ----> http/https -----> 1.1.1.1 ------> 172.10.10.1 port 300

5 REPLIES 5
Highlighted
Beginner

If I'm understanding you correctly, you're saying if traffic sourced from 33.33.33.33 destined to 1.1.1.1 on port 443, then translate 1.1.1.1 to 172.10.10.1 and 443 to 300

      object network 33.33.33.33-obj
        host 33.33.33.33
      object network 1.1.1.1-obj
        host 1.1.1.1
      object network 172.10.10.1-obj
        host 172.10.10.1
      object service tcp-443
        service tcp destination eq https
      object service tcp-300
        service tcp destination eq 300
      nat (Outside,Inside) 1 source static 33.33.33.33-obj 33.33.33.33-obj destination static 1.1.1.1-obj 172.10.10.1-obj service tcp-443 tcp-300
Highlighted

thank you! I'll give it a try and let you know!

Highlighted
VIP Advocate

as you never mentioned what port you coming in. so assuming the coming port could be any number. and other thing do have a spare public ip address on outside interface or you want to land your outside traffic on your public facing asa interface and than doing the mapping?

here is the config if you have a public ip address as you mentioned in your post.

 

object network SERVER
host 172.10.10.1
!
object network PUBLIC
host 1.1.1.1
!
nat (inside,outside) source static SERVER PUBLIC
!
access-list OUTSIDE_IN extended permit tcp any object SERVER eq 300
access-group OUTSIDE_IN in interface outside

please do not forget to rate.
Highlighted

I'll be coming on on 443 and 80 which should then transalate to port 333. I have a spare IP on outside, lets say its 1.1.1.1

Highlighted

object network SERVER
host 172.10.10.1
!
object network PUBLIC
host 1.1.1.1
!
object service CUSTOM80
service tcp source eq 80
!
object service CUSTOM300
service tcp source eq 300
!
nat (inside,outside) source static SERVER PUBLIC service CUSTOM80 CUSTOM300
!
access-list OUTSIDE_IN extended permit tcp any object SERVER eq 80
access-group OUTSIDE_IN in interface outside
!

please do not forget to rate.
Content for Community-Ad