Static NAT doesn't work.

[Yong Peng]

Greeting.

The static NAT configuration doesn't work on ASA Version 8.6(1)2.

Can anybody help me to take a look please?

object network n5k-1

host 10.232.11.190

object network n5k-2

host 10.232.11.189

object service telnet

service tcp source eq telnet

object service telnet-1

service tcp source eq 1025

object service telnet-2

service tcp source eq 1026

nat (inside,outside) source static n5k-1 interface service telnet telnet-1

nat (inside,outside) source static n5k-2 interface service telnet telnet-2

access-list outside extended permit ip any any

access-group outside in interface outside

I can't telnet "outside IP":1025, or 1026.

[blau grana]

Hello Peng,

I tried your configuration on ASA8.4(2) in GNS and it worked. Try to check other devices in path if communication is not filtered somewhere else.

Best Regards

Please rate all helpful posts and close solved questions

[saurabhgoel169 · Accepted solution]

Hi Peng,

You are using Static NAt and applying it with Interface IP address which is incorrect.  As other users are also using the interface IP address for outside communication. Try to use specific public IP address for static NAT instead of Inetrafce IP address.

Let me know the result

Thanks

Saurabh

[Yong Peng]

I did second try:

object network n5k-1

host 10.232.11.190

object network n5k-2

host 10.232.11.189

object network n5k-1

nat (inside,outside) static interface service tcp telnet 8000

CNSHFW132-20# sh run nat

nat (inside,outside) source static pat pat destination static vpn vpn

nat (inside,outside) source dynamic pat interface

!

object network n5k-1

nat (inside,outside) static interface service tcp telnet 8000

CNSHFW132-20#

CNSHFW132-20# sh xlate

TCP PAT from inside:10.232.11.190 23-23 to outside:112.64.156.xx 8000-8000
    flags sr idle 0:06:19 timeout 0:00:00

it doesn't work.

If I change the " interface" to a specific public IP, it works.

I think it must be a bug...

[Yong Peng]

I really hate the version higher than 8.2(5)

it is totally different with earlier version.

thanks for your help.

iwill check other stuff and get back to u

[Jouni Forss]

Hi,

To help a bit with the new 8.3+ NAT format you could look at these 2 documents atleast

A NAT 8.3+ Document I made recently

https://supportforums.cisco.com/docs/DOC-31116

A good NAT 8.2 vs 8.3+ Document

https://supportforums.cisco.com/docs/DOC-9129

- Jouni