Need some clarification with NAT on ASA

[Stan Spice]

Hi,

Need some clarification with NAT on ASA

Can we NAT a public IP to two internals IP's on same port

Example below
static (dmz1,outside) 4.4.4.4 192.168.1.2 netmask 255.255.255.255
static (dmz1,outside) 4.4.4.4 192.168.1.3 netmask 255.255.255.255
access-list outtoin extended permit tcp any host 4.4.4.4 eq www
access-list outtoin extended permit tcp any host 4.4.4.4 eq https

Thanks

stan

[Jouni Forss]

Hi,

Seems you are using software 8.2 or something below.

Dont think you are able to configure the above Static NAT and make it work.

Notice that if you wanted to only forward a certain port with Static PAT then the configuration would look like this

static (dmz1,outside) tcp 4.4.4.4 80 192.168.1.2 80 netmask 255.255.255.255

static (dmz1,outside) tcp 4.4.4.4 443 192.168.1.2 443 netmask 255.255.255.255

Though even in the case of the above Port Forward / Static PAT configuration I dont think the ASA will accept the configuration.

EDIT: Meaning that you cant do the above configuration for both of the Internal DMZ hosts.

On newer softwares you can forward the same ports to different hosts BUT I still think it will not work in a situation where you would want anyone to be able to connect to both of the hosts. You would have to modify the NAT rules to apply only to certain source IP addresses on the Internet.

- Jouni