Solved

Cisco ASA Port Forwarding Using Dynamic NAT

Posted on 2010-09-10
3
752 Views
Last Modified: 2012-05-10
I understand NAT and I understand other routers.  Just not sure how these ASAs deal with Dynamic NAT. I have a Cisco ASA5505 and I need to forward SSL to an internal ip address.
I am already using 3 static NATs to other servers in my enviornment.  I have one IP address definded as my WAN interface and one definded for dynamic NAT for my other nodes on the network.  I only have 5 WAN IP Addresses. See below:

global (outside) 1 interface
global (outside) 1 [WANIPADDRESS #5] netmask 255.0.0.0
nat (inside) 1 192.168.70.0 255.255.255.0
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) [WANIPADDRESS #2]  192.168.70.210 netmask 255.255.255.255
static (inside,outside) [WANIPADDRESS #3]  192.168.70.220 netmask 255.255.255.255
static (inside,outside) [WANIPADDRESS #4]  192.168.70.222 netmask 255.255.255.255
access-group inside_access_out in interface inside
access-group outside_access_in in interface outside

What I need to know is can I forward HTTPS to 192.168.70.3 for my [WANIPADDRESS #5]?  If so how?

Thaks for your assistance

OsageNDN
0
Comment
Question by:Neadom Tucker
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 5

Assisted Solution

by:BooSTid
BooSTid earned 200 total points
ID: 33647381
Following line is the syntax for just doing individual ports (PAT rather then NAT)

static (inside,outside) tcp [WANIPADDRESS 5] 443 192.168.70.3 443 netmask 255.255.255.255                            
0
 
LVL 4

Accepted Solution

by:
ullas_unni earned 300 total points
ID: 33648587
what BooSTid posted is the command for static and make sure you have :

access-list outside_access_in permit tcp any host [WANIPADDRESS 5] eq 443

another thing i noticed is you have:

global (outside) 1 interface
global (outside) 1 [WANIPADDRESS #5] netmask 255.0.0.0
nat (inside) 1 192.168.70.0 255.255.255.0
nat (inside) 1 0.0.0.0 0.0.0.0

i guess

nat (inside) 1 0.0.0.0 0.0.0.0
global (outside) 1 interface

should be sufficient for your other nodes considering 192.168.70.0 is your internal network.
so like that you get WANADDRESS#5 free for the static.

0
 
LVL 6

Author Closing Comment

by:Neadom Tucker
ID: 33650293
Thanks for you help
0

Featured Post

Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

For months I had no idea how to 'discover' the IP address of the other end of a link (without asking someone who knows), and it drove me batty. Think about it. You can't use Cisco Discovery Protocol (CDP) because it's not implemented on the ASAs.…
There’s a movement in Information Technology (IT), and while it’s hard to define, it is gaining momentum. Some call it “stream-lined IT;” others call it “thin-model IT.”
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…
Suggested Courses

615 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question