Solved

PAT on ASA with single global IP

Posted on 2013-05-23
5
557 Views
Last Modified: 2013-05-29
I have a 5525 ASA and need to get a PAT for port 8280 from the outside to the inside. i need all the steps involved remembering the newest version of ASA the NAT/PAT commands have changed. single outside to internal 172.16.22.3 8280


interface GigabitEthernet0/0

 nameif outside



 ip address 50.201.x.x 255.255.255.252

interface GigabitEthernet0/7

 nameif inside

 security-level 100

 ip address 172.16.22.1 255.255.255.248

interface GigabitEthernet0/7

 nameif inside

 security-level 100

 ip address 172.16.22.1 255.255.255.248
0
Comment
Question by:cj_cb
  • 2
  • 2
5 Comments
 
LVL 20

Expert Comment

by:woolnoir
ID: 39193294
object network obj-172.16.22.3
 host 172.16.22.3
 nat (inside,outside) static 50.201.x.x service tcp 8280 8280

that should work ?
0
 
LVL 20

Expert Comment

by:woolnoir
ID: 39193298
i should add i dont have a device to test that one with the new version, but it looks like http://www.cisco.com/en/US/docs/security/asa/asa83/upgrading/migrating.html#wp113630 gives the info, specifically the regular static PAT in table 6
0
 

Author Comment

by:cj_cb
ID: 39193349
i have tried that command, with no success from what i can find this is the latest ASA version and the nat commands have changed drastically on 8.4x.
I have found this and have not tried yet. this is a single outside IP

ASA(config)#nat (inside,outside) source dynamic

fw01# conf t
-fw01(config)# obje
-fw01(config)# object network static-pat-tcp
-fw01(config-network-object)# host 172.16.22.3
-fw01(config-network-object)# nat(inside,outside) static interface service $

nat(inside,outside) static interface service tcp 8280 8280
   ^
ERROR: % Invalid input detected at '^' marker.
nmi-fw01(config-network-object)#
0
 
LVL 18

Expert Comment

by:fgasimzade
ID: 39193531
Here is what you need:

object network obj-172.16.22.3
   host 172.16.22.3
   nat (inside,outside) static 172.16.22.3 service tcp 8280 8280

Is it TCP by the way?

You would also need to add an access-list to your outside interface

access-list outside_access_in extended permit tcp any host 172.16.22.3  eq 8280
0
 
LVL 18

Accepted Solution

by:
fgasimzade earned 500 total points
ID: 39193538
Sorry, forget my last post. It should be

object network obj-172.16.22.3
   host 172.16.22.3
   nat (inside,outside) static interface service tcp 8280 8280


access-list outside_access_in extended permit tcp any host 172.16.22.3  eq 8280
0

Featured Post

Use Case: Protecting a Hybrid Cloud Infrastructure

Microsoft Azure is rapidly becoming the norm in dynamic IT environments. This document describes the challenges that organizations face when protecting data in a hybrid cloud IT environment and presents a use case to demonstrate how Acronis Backup protects all data.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Quality of Service (QoS) options are nearly endless when it comes to networks today. This article is merely one example of how it can be handled in a hub-n-spoke design using a 3-tier configuration.
Outsource Your Fax Infrastructure to the Cloud (And come out looking like an IT Hero!) Relative to the many demands on today’s IT teams, spending capital, time and resources to maintain physical fax servers and infrastructure is not a high priority.
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

830 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question