static nat for server in ASA 8.6

[mahesh18]

Hi Everyone,

We have server with public IP and users from outside internet need access to it.
On firewall outside interface i config the ACL to allow access to server on certain ports.

For traffic back from the server i need to config the NAT
Outside interface of firewall has public IP.

NAT config i need to verify here

object network obj-192.168.100.0
 subnet 192.168.100.0 255.255.255.0
object network obj-192.168.100.33
 host 192.168.100.33

interface GigabitEthernet0/1
 no shutdown
 nameif inside
 security-level 100
 ip address 192.168.100.25 255.255.255.0

object network obj-192.168.100.0
 nat (inside,outside) dynamic interface

object network obj-192.168.100.33
 nat (inside,outside) static 131.x.x.x

Regards
Mahesh

[Akshay Rastogi · Accepted solution]

Hi Mahesh,

You configuration is correct.

You static nat statement would take care of bidirectional traffic(return traffic would be handled by the xlate entry formed by this static nat). You dynamic nat would help providing the internet access to your 192.168.100.0 subnet.

As you are using post 8.3 version, you need to configure private address(192.168.100.33) as destination in outside ACL as post 8.3 version uses Real IP for allowing traffic on outside.

Mark the answer as correct if it answers your queries.

Regards,

Akshay Rastogi

[mahesh18]

So for traffic to server from outside I am using real ip on ACL on outside interface.

Is this correct?

Regards

Mahesh

[Jon Marshall · Accepted solution]

Yes that is correct.

Jon

[mahesh18]

Many thanks Jon

[Akshay Rastogi]

Hi Mahesh,

Yes. It is new way it is configured in versions post 8.3. You could go through the link below to understand the changes done from version pre 8.3 to post 8.3 :

http://www.cisco.com/c/en/us/td/docs/security/asa/asa83/upgrading/migrating.html

Regards,

Akshay Rastogi