etting up Cisco ASA 5505 for multiple external IPs

AS long as the network services are unique and they map to unique servers then you can use PAT or overload NAT using only the single outside interface IP for all services. However, if you need to use
similar services like http on multiple devices then you can use multiple public IPs and perfrorm static nat translations.

So for overload NAT do the following;

global (outside) 1 interface
nat (inside) 0 access-list NONAT
nat (inside) 1  192.168.1.0 255.255.255.0

access-list NONAT permit ip x.x.x.x y.y.y.y.y a.a.a.a b.b.b.b (ex:for traffic you do not want to NAT, may not  
                                                                                                   any, there just in case you do

static (inside,outside) tcp interface ftp 192.168.1.18 3389 netmask 255.255.255.255
static (inside,outside) tcp interface ftp 192.168.1.31 21 netmask 255.255.255.255
ftp mode passive
access-list outside permit tcp any host xx.yy.zz.18 eq 3389   (try to limit the source if possible)
access-list outside permit tcp any host xx.yy.zz.18 eq 21       (try to limit the source if possible)

harbor235 ;}

 

So for static I should use?:

static (inside,outside) tcp interface ftp 192.168.1.18 3389 netmask 255.255.255.255
static (inside,outside) tcp interface ftp 192.168.1.31 21 netmask 255.255.255.255
ftp mode passive
access-list outside permit tcp any host xx.yy.zz.18 eq 3389   (try to limit the source if possible)
access-list outside permit tcp any host xx.yy.zz.18 eq 21       (try to limit the source if possible)

This is an overload NAT config, so yes this allows for any source IP to connect to the outside IP for the FW and redirect 3389 to internal server 192.168.1.18 and 21 to 192.168.1.31.

harbor235 ;}

I need to do similar services on multiple devices so we can use multiple public IPs and perfrorm static nat translations

what are those commands?

here is my current config. It does not get through using the public IP XXX.YYY.ZZZ.51 either

: Saved
:
ASA Version 7.2(4)
!
hostname ciscoasa
domain-name hillary.com
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
name XXX.YYY.ZZZ.31 FTP description Dell FTP Server
name 192.168.1.2 HP9000 description HP9000 Inside
name XXX.YYY.ZZZ.2 HP9000-Outside description HP9000 From Outside
name 192.168.1.18 TS-Inside description W2K Terminal Server
name XXX.YYY.ZZZ.18 TS-Outside description W2K Terminal Server
name 192.168.1.31 DELL-FTP-Server-Inside
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.1.254 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address XXX.YYY.ZZZ.51 255.255.255.128
!
interface Vlan3
 no forward interface Vlan1
 nameif dmz
 security-level 50
 ip address 192.168.0.31 255.255.255.0
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
 switchport access vlan 3
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
dns domain-lookup inside
dns domain-lookup outside
dns server-group DefaultDNS
 name-server 198.6.1.4
 name-server 198.6.1.3
 domain-name hillary.com
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object-group service FTP tcp
 description Ftp Service Group
 port-object eq ftp
object-group service TerminalServer tcp
 port-object eq 3389
access-list outside_in extended permit tcp any interface outside eq 3389
access-list outside_in extended permit tcp any interface outside eq ftp
access-list outside_access_in extended permit tcp any host TS-Inside eq 3389
access-list outside_access_in extended permit tcp any host DELL-FTP-Server-Inside eq ftp
access-list outside extended permit tcp any host TS-Outside eq 3389
access-list outside extended permit tcp any host FTP eq ftp
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu dmz 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-524.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
static (outside,dmz) tcp interface ftp FTP ftp netmask 255.255.255.255
static (inside,outside) tcp interface ftp DELL-FTP-Server-Inside ftp netmask 255.255.255.255
static (inside,outside) tcp interface 3389 TS-Inside 3389 netmask 255.255.255.255
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 XXX.YYY.ZZZ.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!
dhcpd dns 198.6.1.4 198.6.1.3 interface inside
!

!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:53d9e081ca215c36b0ed47be14500780
: end
asdm image disk0:/asdm-524.bin
asdm location HP9000-Outside 255.255.255.255 inside
asdm location HP9000 255.255.255.255 inside
asdm location DELL-FTP-Server-Inside 255.255.255.255 inside
no asdm history enable

Just use the static commands with the external IPs and ACLs entries to allow the traffic. AS far as NAT goes craft the NONAT ACL that I gave you above and create entries for the servers you do not want to be overload NAT'd. Then add the static commands with the specific outside IPs

Example, use overload NAT but use a seperate Public IP for RDP server
global (outside) 1 interface
nat (inside) 0 access-list NONAT
nat (inside) 1  192.168.1.0 255.255.255.0

access-list NONAT permit ip host 192.168.1.18 any (do not nat the RDP server)
static (inside,outside) ip <PUBLIC_IP> 3389 192.168.1.18 3389 netmask 255.255.255.255
access-list outside permit tcp any host <PUBLIC_IP> eq 3389   (try to limit the source if possible)

Found a typo in my first config post, here it is again;

So for overload NAT do the following;

global (outside) 1 interface
nat (inside) 0 access-list NONAT
nat (inside) 1  192.168.1.0 255.255.255.0

access-list NONAT permit ip x.x.x.x y.y.y.y.y a.a.a.a b.b.b.b (ex:for traffic you do not want to NAT, may not  
                                                                                                   any, there just in case you do

static (inside,outside) tcp interface 3389 192.168.1.18 3389 netmask 255.255.255.255
static (inside,outside) tcp interface ftp 192.168.1.31 21 netmask 255.255.255.255
ftp mode passive
access-list outside permit tcp any host xx.yy.zz.18 eq 3389   (try to limit the source if possible)
access-list outside permit tcp any host xx.yy.zz.18 eq 21       (try to limit the source if possible)


harbor235 ;}

This line gives me an error

static (inside,outside) ip <PUBLIC_IP> 3389 192.168.1.18 3389 netmask 255.255.255.255

Result of the command: "static (inside,outside) ip xxx.yyy.zzz.18 3389 192.168.1.18 3389 netmask 255.255.255.255"

static (inside,outside) ip xxx.yyy.zzz.18 3389 192.168.1.18 3389 netmask 255.255.25                         ^5.255

ERROR: % Invalid Hostname



If I use
static (inside,outside) tcp <PUBLIC_IP> 3389 192.168.1.18 3389 netmask 255.255.255.255
It takes it, but it also does not work

Complete listing below:

: Saved
:
ASA Version 7.2(4)
!
hostname ciscoasa
domain-name hillary.com
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
name xxx.yyy.zzz.31 FTP description Dell FTP Server
name 192.168.1.2 HP9000 description HP9000 Inside
name xxx.yyy.zzz.2 HP9000-Outside description HP9000 From Outside
name 192.168.1.18 TS-Inside description W2K Terminal Server
name xxx.yyy.zzz.18 TS-Outside description W2K Terminal Server
name 192.168.1.31 DELL-FTP-Server-Inside
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.1.254 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address xxx.yyy.zzz.51 255.255.255.128
!
interface Vlan3
 no forward interface Vlan1
 nameif dmz
 security-level 50
 ip address 192.168.0.31 255.255.255.0
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
 switchport access vlan 3
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
dns domain-lookup inside
dns domain-lookup outside
dns server-group DefaultDNS
 name-server 198.6.1.4
 name-server 198.6.1.3
 domain-name hillary.com
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object-group service FTP tcp
 description Ftp Service Group
 port-object eq ftp
object-group service TerminalServer tcp
 port-object eq 3389
access-list outside extended permit tcp any host FTP eq ftp
access-list outside extended permit tcp any host TS-Outside eq 3389
access-list NONAT extended permit ip host TS-Inside any
access-list NONAT extended permit ip host DELL-FTP-Server-Inside any
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu dmz 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-524.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list NONAT
nat (inside) 1 192.168.1.0 255.255.255.0
nat (inside) 1 0.0.0.0 0.0.0.0
static (outside,dmz) tcp interface ftp FTP ftp netmask 255.255.255.255
static (inside,outside) tcp TS-Outside 3389 TS-Inside 3389 netmask 255.255.255.255
route outside 0.0.0.0 0.0.0.0 xxx.yyy.zzz.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!
dhcpd dns 198.6.1.4 198.6.1.3 interface inside
!

!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:c1b426d8cff31757ae0a96ed94a5b5c0
: end
asdm image disk0:/asdm-524.bin
asdm location HP9000-Outside 255.255.255.255 inside
asdm location HP9000 255.255.255.255 inside
asdm location DELL-FTP-Server-Inside 255.255.255.255 inside
no asdm history enable

Right, gave you an error because the static command had IP instead of TCP, 3389 is not a valid IP port.
Is all else ok?

harbor235 ;}

Still cannot get static to work, so I reverted back to NAT for now, but since I have users on I have to leave as is for now.

I will try again tonight / tomorrow morning and let you know how I make out.

I have it so the Overloaded NAT is working, but I need to get a few other IP's forwareded to different machines.

There are 3 machnes I need to get to using port 3389, I have the most important one working with the Overloaded NAT, but what do i add / change to be able to forward x.x.x.17 to 192.168.1.17 and x.x.x.199 to 192.168.1.199? while still having the original x.x.x.50 to to 192.168.1.18

Thanks

harbor235, I have not forgot you, just have not had time to setup the other redirects as you listed. Hiope to do that this weekend.. Thanks for your patience,

Thanks for your help..