NAT Port Translation HELP!

[Scott Danton]

I have a server on the inside of my network (with a internet Routable IP).  It has been requested to me that people from the internet access port 80, and that is translated at the firewall to port 7080.  I have set up a temp Access rule to allow access to 7080 from the outside and it is accessable.  I am not sure what I am doing wrong, but I am not able to get the translation from 80 to 7080 to work.  Please advise.

Scott

[Jouni Forss]

Hi,

I guess your setup would be abit diffrent from the typical situation since you have an actual public IP address on the host itself but still need to manipulate the ports towards Internet.

The basic configuration format (that I use) for Port Forward / Static PAT is the following

object network STATIC

host

nat (inside,outside) static service tcp

In this case I guess the =

access-list OUTSIDE-IN permit tcp any object STATIC eq

You can confirm operation with

packet-tracer input outside tcp 1.2.3.4 1234

One optional way of doing this regarding NAT might be

object service REAL-PORT

service tcp source eq

object service MAPPED-PORT

service tcp source eq

object network IP-ADDRESS

host

nat (inside,outside) source static IP-ADDRESS IP-ADDRESS service REAL-PORT MAPPED-PORT

Hope this helps

- Jouni