asked on What Cisco device do I need to do ip address and port mapping
What Cisco device do I need to do ip address and port mapping? I need to translate incoming destinations and ports into internal destination host and port. Something like this:
- using Cox IP 98.175.98.10 as our outside static IP address in this example.
DESTINATION REPLACEMENT DEST
map 98.175.98.10 8443 to 192.168.168.100 443
map 98.175.98.10 8080 to 192.168.168.101 80
With an IN acl like this
permit 215.50.5.0/24 any
Will a 2921 do this or do I need an ASA firewall?
- using Cox IP 98.175.98.10 as our outside static IP address in this example.
DESTINATION REPLACEMENT DEST
map 98.175.98.10 8443 to 192.168.168.100 443
map 98.175.98.10 8080 to 192.168.168.101 80
With an IN acl like this
permit 215.50.5.0/24 any
Will a 2921 do this or do I need an ASA firewall?
CiscoNetworking
Last Comment
huffmana
ASKER
Thanks max_the_king. Yes the 2921 is NAT overloading the outside Static IP address. I am managing the 2921. The NAT is working but how do I configure the incoming Port Mapping?
ASKER CERTIFIED SOLUTION
THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
max_the_king's code is OK, except the part that ACL is, most likely, not needed.
Static source NAT is correctly configured (if interfaces are configure with "ip nat inside | ip nat outside" should be OK).
Static source NAT is correctly configured (if interfaces are configure with "ip nat inside | ip nat outside" should be OK).
ASKER
I ended up getting an ASA because it'll be easier manage ports. The 2921 will NAT and PAT and ACL could close ports.... I'll try anyway, but the ASA5520 has 4 GI ports and things like DMZ.... it was only $130 on ebay.
ASKER
Great help you guys. I appreciate your expert advise.
you will probably do that into the ASA firewall, although it is possible to do it into the router (2921).
It depends on which one is managing NAT; having both it is more likely that you do that on ASA. Besides, 2921 might belong to your ISP.
hope this helps
max