Need www access to LAN server, but no outside physical port available.

[jmaxwellUSAF]

Hello.

Goal: To allow a www user to access an internal enterprise server by using external IP address 1.1.1.8/24

Details: The border device is an ASA 5525 with no available physical ports. There does exist a port with address 1.1.1.1/24 . The internal server only has a 172.16.0.x/24 address.

What is the correct way to engineer this www to server connectivity?

Thank you.

[M02@rt37]

Hello @jmaxwellUSAF 

Given the constraints of the ASA5525 having no available physical ports and an existing port with address 1.1.1.1/24, a possible solution is to use DNAT or Port Forwarding.

Assuming you want to forward HTTP traffic from the external IP 1.1.1.1 to the internal server at 172.16.0.x, you can configure a static PAT on the ASA:

#Configure static PAT for www traffic
object network InternalServer
host 172.16.0.x
nat (inside,outside) static interface service tcp www www

#Allow incoming www traffic from any source to the external IP
access-list outside_access_in extended permit tcp any interface outside eq www
access-group outside_access_in in interface outside

This configuraton allows external users to access the internal server using the external IP address 1.1.1.1, and the ASA forwards the www traffic to the internal server. Adjust with your specific needs and security policies.

[jmaxwellUSAF]

Thank you for your reply.

ASA interface 1.1.1.1 already has much www traffic hitting it. I expect it is possible that a static PAT could be used. 

What would be that config? 

If it is still relevant, may you please explain the logic of your below config...

nat (inside,outside) static interface service tcp www www ?

Thank you.

[MHM Cisco World]

You use PAT 1:1

if you access server by outside interface public ip

OR

if you access server by ip reachable by outside interface.

Here the public IP that make client use to access server is it reachable via outside interface?

Keep notice the NAT not working if the IP use is not reachable 

MHM

[jmaxwellUSAF]

I suppose I could use PAT, because 1.1.1.1/24 is accessible by www.

I would like to use 1.1.1.8/24 because this is what old broken config used. (Before i worked here this server was moved from different city. The new destination never yet had IP connectivity. Currently the config is a big mess. I figured I would start fresh greenfield config.)

I do not have evidence that 1.1.1.8/24 can be reached via www, BUT I can see the entire subnet is advertised via BGP, so I would expect 1.1.1.8/24 would be reachable. 

May you please display one or both configs you think will work here?

Thank you.

[jmaxwellUSAF]

helpful link on 1:1 static PAT...

CLI Book 2: Cisco ASA Series Firewall CLI Configuration Guide, 9.7 - Network Address Translation (NAT) [Cisco ASA 5500-X Series Firewalls] - Cisco

...

Examples

The following example shows the use of static interface NAT with port translation. Hosts on the outside access an FTP server on the inside by connecting to the outside interface IP address with destination port 65000 through 65004. The traffic is untranslated to the internal FTP server at 192.168.10.100:6500 through 65004. Note that you specify the source port range in the service object (and not the destination port) because you want to translate the source address and port as identified in the command; the destination port is “any.” Because static NAT is bidirectional, “source” and “destination” refers primarily to the command keywords; the actual source and destination address and port in a packet depends on which host sent the packet. In this example, connections are originated from outside to inside, so the “source” address and port of the FTP server is actually the destination address and port in the originating packet.

hostname(config)# object service FTP_PASV_PORT_RANGE
hostname(config-service-object)# service tcp source range 65000 65004

hostname(config)# object network HOST_FTP_SERVER
hostname(config-network-object)# host 192.168.10.100

hostname(config)# nat (inside,outside) source static HOST_FTP_SERVER interface
service FTP_PASV_PORT_RANGE FTP_PASV_PORT_RANGE

The following example shows a static translation of one IPv6 network to another IPv6 when accessing an IPv6 network, and the dynamic PAT translation to an IPv4 PAT pool when accessing the IPv4 network:

hostname(config)# object network INSIDE_NW
hostname(config-network-object)# subnet 2001:DB8:AAAA::/96

hostname(config)# object network MAPPED_IPv6_NW
hostname(config-network-object)# subnet 2001:DB8:BBBB::/96

hostname(config)# object network OUTSIDE_IPv6_NW
hostname(config-network-object)# subnet 2001:DB8:CCCC::/96

hostname(config)# object network OUTSIDE_IPv4_NW
hostname(config-network-object)# subnet 10.1.1.0 255.255.255.0

hostname(config)# object network MAPPED_IPv4_POOL
hostname(config-network-object)# range 10.1.2.1 10.1.2.254

hostname(config)# nat (inside,outside) source static INSIDE_NW MAPPED_IPv6_NW
destination static OUTSIDE_IPv6_NW OUTSIDE_IPv6_NW
hostname(config)# nat (inside,outside) source dynamic INSIDE_NW pat-pool MAPPED_IPv4_POOL
destination static OUTSIDE_IPv4_NW OUTSIDE_IPv4_NW

[jmaxwellUSAF]

If the adjacent device connected to the ASA outside 1.1.1.1 interface, has IP address 1.1.1.2/24...

... Can I create a sub-interface on the same physical port of the ASA "outside" interface, and create on this sub-interface IP-Address 1.1.1.8/24? Will this behave as a logically separate routable interface?

Or will this just not work?