What Cisco device do I need to do ip address and port mapping

huffmana
huffmana used Ask the Experts™
on
What Cisco device do I need to do ip address and port mapping?  I need to translate incoming destinations and ports into internal destination host and port.  Something like this:
-  using Cox IP 98.175.98.10 as our outside static IP address in this example.
DESTINATION                      REPLACEMENT DEST
map 98.175.98.10 8443  to 192.168.168.100 443
map 98.175.98.10 8080  to 192.168.168.101 80

With an IN acl like this
permit 215.50.5.0/24 any

Will a 2921 do this or do I need an ASA firewall?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Hi,
you will probably do that into the ASA firewall, although it is possible to do it into the router (2921).
It depends on which one is managing NAT; having both it is more likely that you do that on ASA. Besides, 2921 might belong to your ISP.

hope this helps
max
huffmanaSystem Admin and Network Engineer

Author

Commented:
Thanks max_the_king.  Yes the 2921 is NAT overloading the outside Static IP address.  I am managing the 2921.  The NAT is working but how do I configure the incoming Port Mapping?
Hi,
something like:

ip nat inside source static tcp 192.168.168.100 443  98.175.98.10 8443 extendable
ip nat inside source static tcp 192.168.168.101 80  98.175.98.10 8080 extendable

and then you need an acl:

something like:

access-list 100 permit   tcp any 98.175.98.10 eq 8443
access-list 100 permit   tcp any 98.175.98.10 eq 8080

max

P.S.: my advice is to use ASA for NAT and ACL
Ensure you’re charging the right price for your IT

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Distinguished Expert 2018

Commented:
max_the_king's code is OK, except the part that ACL is, most likely, not needed.
Static source NAT is correctly configured (if interfaces are configure with "ip nat inside | ip nat outside" should be OK).
huffmanaSystem Admin and Network Engineer

Author

Commented:
I ended up getting an ASA because it'll be easier manage ports.  The 2921 will NAT and PAT and ACL could close ports....  I'll try anyway, but the ASA5520 has 4 GI ports and things like DMZ.... it was only $130 on ebay.
huffmanaSystem Admin and Network Engineer

Author

Commented:
Great help you guys.  I appreciate your expert advise.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial