Static NAT question

[ksarin123_2]

Hi folks -

I have a host in the DMZ that has a one-2-one static NAT on an ASA 5510. The IP address of the host in the DMZ is 192.168.128.20. Now we have added two more hosts in the DMZ that have been clustered with 192.168.128.20. The IP addresses of two additional hosts in the cluster is 192.168.128.26 & .28.

Now when communication goes out from the server cluster in the DMZ, I've been told the cluster will choose any IP address (.20, .26 or .28) for outbound communication. I added another NAT statement on the 5510 that NAT's .26 & .28 to a public IP address. This public IP address is different from the public IP address that has been assigned to .20.

So my question is, Can I have the below configuration without causing any problems? My goal is to keep the static NAT that is in place for .20, and also NAT .26 and .28 to the same public IP address as .20. Also, when vendors communicate with the server cluster in the DMZ, they use the IP address of 99.99.99.100 (not the real address ofcourse!!)

static (dmz,outside) 99.99.99.100 192.168.128.20 netmask 255.255.255.255

access-l TEST extended per ip host 192.168.128.20 any

access-l TEST extended per ip host 192.168.128.26 any

access-l TEST extended per ip host 192.168.128.28 any

static (dmz,outside) 99.99.99.100 access-l TEST

[Jon Marshall]

Kunal

See this recent thread discussing the same issue -

http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Security&topic=Firewalling&topicID=.ee6e1fa&fromOutline=&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cd28488

Jon

[ksarin123_2]

Jon -

Thanks for your prompt response. However, my situation is slightly different. I am looking to keep the static NAT in place (for .20) but also NAT .26 and .28 to the same public IP addresses as .20.

So I am looking to map a single public IP address to multiple hosts inside.