Solved

NATting from outside to inside

Posted on 2008-06-20
1
330 Views
Last Modified: 2008-09-25
Hi all,

A customer of ours is having the strangest setup. They have 2 firewalls connecting to the internet. We control only one of them. The other one is the main default gateway for their network.
A few servers use the firewall we control as default gateway (don't ask me why).
Now we need to publish  IP's from servers who's default gateway is pointing to the other firewall

This is what I had but it didn't work:

static (inside,outside) tcp CUSTOMERIP 3200 10.10.10.250 3200 netmask 255.255.255.255
static (inside,outside) tcp CUSTOMERIP 3201 10.10.10.253 3200 netmask 255.255.255.255

access-list outside permit tcp host OURIP host CUSTOMERIP eq 3200
access-list outside permit tcp host OURIP CUSTOMERIP eq 3201

access-list cust_nat permit tcp host OURIP host CUSTOMERIP eq 3200
access-list cust_nat permit tcp host OURIP CUSTOMERIP eq 3201

nat (outside) 2 access-list cust_nat
global (inside) 2 interface


What am I doing wrong?
0
Comment
Question by:o-tvw-ee
1 Comment
 
LVL 6

Accepted Solution

by:
clearacid earned 500 total points
ID: 21831795
Try getting rid of the static NAT tcp translation.

static (inside,outside) CUSTOMERIP 10.10.10.250 3200 netmask 255.255.255.255
static (inside,outside) CUSTOMERIP 10.10.10.253 3200 netmask 255.255.255.255

That way - just the translation is being set in this one and you are controlling TCP access on  your access-lists.
0

Featured Post

Highfive + Dolby Voice = No More Audio Complaints!

Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

Join & Write a Comment

This article assumes you have at least one Cisco ASA or PIX configured with working internet and a non-dynamic, public, address on the outside interface. If you need instructions on how to enable your device for internet, or basic configuration info…
From Cisco ASA version 8.3, the Network Address Translation (NAT) configuration has been completely redesigned and it may be helpful to have the syntax configuration for both at a glance. You may as well want to read official Cisco published AS…
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now