Cisco ASA 5505: How to set up NAT/PAT rules from scratch?

Hi experts,

I need some help again with Cisco ASA (still need to read this 1200 page book entirely...)

I'm setting up a server (on LAN) for some services, and these services need to be accessible from the outside world.

As for the Cisco ASA 5505: Let's assume here that the outside interface has IP address 81.82.83.84 and the inside address is 192.168.1.1. The server has IP address 192.168.1.5

What commands do I exactly need to set this up? My Cisco command-line knowledge is basic. I also would like to know how you do this in ASDM (GUI), so I can compare these two.

Thanks for your feedback!
LVL 8
Mac2010Asked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

SuperTacoCommented:
it's much easier to do using the ASDM, although it is possible to do it CLI.

Here's a link to the ADSM guide.  Just a couple of screen shots.  You will also have to open the ports to the server using the ACL interface (underNAT Rules in ASDM)

http://www.howtocisco.com/cisco/asanat1.htm

-as for CLI, I like to create service groups for each server so the first step is:

conf t

object-group service Exchange tcp
 port-object eq www
 port-object eq https
 port-object eq imap4
 port-object eq pop3
 port-object eq smtp

(or you can use ports number i.e.-80,440, etc)

-Then create and ACL using your group name (it's just eaiser if you need ot modify the object later)

access-list outside_access_in extended permit tcp any host 81.82.82.84 object-group Exchange

-then create the NAT rule

static (inside,outside) tcp 81.82.83.83 https 192.168.1.5 https netmask 255.255.255.255
static (inside,outside) tcp 81.82.83.84 smtp 192.168.1.5 smtp netmask 255.255.255.255
static (inside,outside) tcp 81.82.83.84 pop3 192.168.1.5 pop3 netmask 255.255.255.255
static (inside,outside) tcp 81.82.83.84 imap4 192.168.1.5 imap4 netmask 255.255.255.255
static (inside,outside) tcp 81.82.82.84 www 192.168.1.5 www netmask 255.255.255.255


Here's a good example for RDP that I use as a reference alot.  it has bot CLI and ASDM

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00807d287e.shtml
0
Mac2010Author Commented:
Thanks for your suggestions. I'll test those (on my test ASA) tomorrow - it's late over here. I already tried (via ASDM) suggestions in the second URL you posted. Is using the outside-IP number always needed? This instead of selecting "outside" as interface?
0
lruiz52Commented:
Agree with super taco, but don't forget the command below,

access-group outside_access_in in interface outside
0
Prepare for an Exciting Career in Cybersecurity

Help prevent cyber-threats and provide solutions to safeguard our global digital economy. Earn your MS in Cybersecurity. WGU’s MSCSIA degree program curriculum features two internationally recognized certifications from the EC-Council at no additional time or cost.

Pete LongTechnical ConsultantCommented:
You are simply doing "Port forwarding" or Static PAT

Cisco PIX / ASA Port Forwarding

Pete
0
Mac2010Author Commented:
Thanks again for the feedback!

@PeteLong
I'm going to test the suggestions on your website. I have a question about what I read at this point:

http://www.petenetlive.com/KB/Article/0000077.htm#n83
5. Then create a NAT translation for the port to be forwarded. then you can exit the network object prompt.

What do you write here if you need to forward a port/service that is not predefined? For instance I need to forward "AFP" (Apple Filing Protocol) to the server on TCP port 548 .

The server is a mail server that also has a webinterface. The ASA is version 8.4(1) with ASDM 6.4(1). Do you also have screen shots for this ASDM version?
0
Mac2010Author Commented:
@SuperTaco

The commands you suggest, work (get accepted) until this point:
static (inside,outside) tcp 81.82.83.83 https 192.168.1.5 https netmask 255.255.255.255
When I type it, even copy/paste (with the correct IP numbers), I get this error-message:
ERROR: This syntax of nat command has been deprecated.
Please refer to "help nat" command for more details.
What could be going wrong here?
0
Mac2010Author Commented:
... allo ... allo ...

anyone listening?
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Mac2010Author Commented:
I appreciate the feedback. Unfortunately it didn't help me out...
Cisco Support (TAC) eventually did.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Cisco

From novice to tech pro — start learning today.