Static NAT(for Webserver) doesn't work while PAT(many ip to 1 ip per port translation, or pat overload) is there
object network NGNIX_WEBSERVER
host 10.150.20.253
nat (INSIDE,OUTSIDE) static 12.x.x.x //webserver
nat (INSIDE,OUTSIDE) source static LAN_EF LAN_EF destination static VPNPOOLA VPNPOOLA ///any connect
nat (INSIDE,OUTSIDE) source dynamic LAN_EF interface ///PAT or pat overload
remember my outside interface IP address is different from 12.x.x.x, but 12.x.x.x to my outside interface from the internet as well, so it's part of our ip space.
I guess I know what's wrong, it's the order of operation,
idk why we have this unusefull phenomena in ASA called auto nat, I have to move that static nat from the bottom to the top of the section 1, how should I do that?
thx
asa(config)# show nat
Manual NAT Policies (Section 1)
1 (INSIDE) to (OUTSIDE) source static LAN_EF LAN_EF destination static VPNPOOLA VPNPOOLA
translate_hits = 116, untranslate_hits = 145
2 (INSIDE) to (OUTSIDE) source dynamic LAN_EF interface
translate_hits = 103003, untranslate_hits = 2022
Auto NAT Policies (Section 2)
1 (INSIDE) to (OUTSIDE) source static NGNIX_WEBSERVER 12.x.x.x
translate_hits = 0, untranslate_hits = 4
asa(config)#I also have an access list tooo
access-list OUTSIDE_TO_NGNIX extended permit tcp any host 10.150.20.253
show access-list
access-list OUTSIDE_TO_NGNIX line 2 extended permit tcp any host 10.150.20.253 (hitcnt=255) 0x2a1acd9f
