NAT Help - Enable Public IP to access Internal IP via 1433 Port

[Aamir Bhatti]

Hello All,

I need help as I need to allow Public IP address to access Internal MS SQL Server via 1433 port. Below are the details.

Public Source IP 200.x.x.9
Internal Server Private Addess 10.x.x.126 (this server have a shared Public IP address as well)
Internal Port 1433 (SQL Server)

I am using FMC. and I know I need to use NAT but failing to configure it. 

[MHM Cisco World]

Can I see how you config NAT in FMC

MHM

[Aamir Bhatti]

Hello MHM,

I have done it like this, will you please guide general on steps to do so, keeping in mind the above share details. 

[MHM Cisco World]

the NAT is OK 
do config ACP to allow traffic from Internet to inside ?
check NAT and ACP with packet trace feature of ftd 

MHM

[MHM Cisco World]

Any update of this case?

MHM

[paul driver]

Hello

---

@Aamir Bhatti wrote:
I need help as I need to allow Public IP address to access Internal MS SQL Server via 1433 port. Below are the details.

Public Source IP 200.x.x.9
Internal Server Private Addess 10.x.x.126 (this server have a shared Public IP address as well)
Internal Port 1433 (SQL Server)

---

If you already have a static nat policy, it should be bi-directional, so i would say you just need to make sure you have a acl that will allow traffic to be initiated externally from a lower security interface level - <outside>to access an internal host on a higher security level <inside>

Example:

object network Web-srv
host 10.x.x.127

object network Web-srv-ext-host
host 200.x.x.9

object service TCP1433
service tcp source eq 1433

nat (inside,outside) source static Web-srv Web-srv-ext-host service TCP1433 TCP1433

access-list out-in extended permit ip host 200.x.x.9 host 10.x.x.127
access-group out-in in interface outside

[Aamir Bhatti]

Hello Paul,

Thankyou for your reply, actually I have tired creating the Access Control policy, and NAT rule on FMC for the respective FTD. But I believe I am missing some steps or not putting the Vendor Public IP at the right place. 

Public Source IP 200.x.x.9
Internal Server Private Addess 10.x.x.126 (this server have a shared Public IP address as well)
Internal Port 1433 (SQL Server)

Will you please advise how should I create NAT rule and Policy, where to put which IP. Thankyou. 


Regards,

Aamir

[Aamir Bhatti]

Thanks @MHM Cisco World and @paul driver. problem was resolved, apologies for the delayed reply. Just to share with you it was a prefilter policy that was stopping the traffic. 

Appreciate your help. 

[MHM Cisco World]

As i guess 

Thanks for update us

Have  a nice day 

MHM