What would be the translated sources in NAT rule on Cisco FMC for FTD?

[CiscoBrownBelt]

Just want to be sure. So If establishing connection from internet to private internal server, the translated source would be the private IP want to nat the public IP to? The Translated destination would be the IP of the internal server?

[MHM Cisco World]

OUT (internet)- FTD -IN 

the static NAT is bidirectional 
you can use 
IN

OUT

private IP

port X

ANY

interface 

port X

Any 

this how NAT need to config 

MHM 

[CiscoBrownBelt]

Not sure if I am tracking. So to the translated source would be the private IP I want to use for the external public IP/device trying to access internal server? The Translated destination would be the actual private IP of the internal server?

[MHM Cisco World]

The traffic initiate from OUT (internet) client to server 

The source is client public IP

The destiantion will be public IP (mapped IP of server)

Since the NAT config IN to OUT 

The destiantion public IP (server mapped IP) NATing to private IP (real server IP)

Source client public IP not NATing since we use any to any.

MHM

[CiscoBrownBelt]

So per my screen shot, the Translated Sources is the internal private IP I want to NAT the public/Out host IP to? And the translated destination is the actual internal IP of the server?

[CiscoBrownBelt]

So source = static
Source Int Obj = Outside
Desination Int Obj = Inside
Original Source = my public host IP that wants access to internal server
Original Destination = Public IP/GW for internal server
Original Services = say https
Translated Sources = my public host IP that wants access to internal server
Translated Destination = actual real private IP of internal server need access for

[MHM Cisco World]

[CiscoBrownBelt]

This is for connection from an external outside host to internal server that has private IP. Are you referencing from internal server to external host connection?

[MHM Cisco World]

This NAT since it static it bidirectional

It NATing 

From server to client 

From client to server 

MHM

[CiscoBrownBelt]

I only want the server reachable from one external host out in internet. Internal private IP subnet server is on already has internet access (so from internal to external of course). You are saying just enter NAT in same fashion but enter the external host as the destination?

[Marius Gunnerud · Accepted solution]

How you set up NAT is really up to you, with regard to where you specify the source and destination.  Some prefer to have the internet / external network as the source (I suppose for visualization purposes) and others like the source to be the internal network (this is my preference). You can also limit the NAT rule to a specific port and if you are using the FTD Outside / external interface for this connection then you will need to do that or you will possibly break other connections.

Just keep in mind that static manual NAT are bi-directional by default which is why source and destination are interchangeable and will work if set up correctly.

You will also need access rules on the Outside / external interface on the FTD allowing access from the remote public IP to the internal private IP of the server.

 

[CiscoBrownBelt]

Right thanks and yes aware about rules. So for internal server host, there is already a NAT rule for the entire subnet it is on to reach internet. If entering the statement as In to Out instead, basically the FTD would know to NAT the public host when it tries to connect based on this and the specified port? Placement of this rule does not matter if there is already a NAT statement for In to Out for the entire internal subnet correct?

Also, if you leave Original Source Port/Services blank than that could be ANY? Original Destination Port and Translated Destination Port would be the port you want to use for the connection let's say just want to allow https connection? Basically how do I enter it?

[CiscoBrownBelt]

I entered it in that fashion, show xlate shows the internal IP natted to public ip but the public host has the following in show xlate. Shouldn't the Inside IP (changed IP text for private purposes) be the internal host?

TCP PAT from Outside:1.1.1.1 443 to Inside:1.1.1.1 443
flags srT idle 1:08:50 timeout 0:00:00

[Marius Gunnerud]

in the xlate the inside IP should be the private IP of the server, the Outside IP should be the NAT / PAT public IP.

[MHM Cisco World · Accepted solution]

You are saying just enter NAT in same fashion but enter the external host as the destination? <<- in my previous comment I never mention that we need NATing the destination
I think I know what you confuse about 
static NAT for server from private to public IP can config in two way
1- IN OUT <<- interface
the source is private IP of server and it NATing to public IP 
2- OUT IN <<- interface
the destination is Public IP of server and it NATing to private IP 

there is no different since as I mention before it bidirectional NAT 

if you have more Q please ask 
thanks 

MHM