Cisco ASA Static Service Port NAT..

WAN INBOUND SERVICES NAT..

Dynamic Nat :

object-group network Public_IP_196
description Dynamic NaT Public_IP
network-object host 194.75.244.196
!
object network Private_Lan
Description Private Lan Network
subnet 172.16.0.0 255.255.0.0
nat (HQ_LAN,PUBLIC) dynamic interface

!
!

Service Port Translation (PAT) Configuration :

PORT 81

object-group network Public_IP_197
description Public_IP
network-object host 194.75.244.197
!
object network Private_IP_1.28_81
host 172.16.1.28
description Private IP Crystal Report
nat (HQ_LAN,PUBLIC) static Public_IP_197 service tcp 81 81
!
object-group service Obj-Service_81 tcp
port-object eq 81
!
!

Here you configure Inbound ACL :

access-list Public_access_in line 12 remark Crystal_Reports
access-list Public_access_in line 13 extended permit tcp any object Private_IP_1.28_81
object-group Obj-Service_81

!

Here you Configure a Static NaT with added reverse NaT
Translation :

nat (HQ_LAN,PUBLIC) source static Private_IP_1.28_81 Public_IP_197 destination static Public_IP_197 Private_IP_1.28_81

PORT 443

object network Private_IP_1.36_https
description Private IP SSL Front End Mail
host 172.16.1.36
nat (HQ_LAN,PUBLIC) static Public_IP_197 service tcp 443 443
!
object-group service Obj-Service_https tcp
port-object eq 443
!
access-list Public_access_in line 14 remark Front_End_Mail
access-list Public_access_in line 15 extended permit tcp any object Private_IP_1.36_https
object-group Obj-Service_https
!
nat (HQ_LAN,PUBLIC) source static Private_IP_1.36_https Public_IP_197 destination static Public_IP_197 Private_IP_1.36_https

PORT 80

object network Private_IP_1.20_http
description Private_IP IT Helpdesk
host 172.16.1.20
nat (HQ_LAN,PUBLIC) static Public_IP_197 service tcp 80 80
!
object-group service Obj-Service_http tcp
port-object eq 80
!
access-list Public_access_in line 16 remark Front_End_Mail
access-list Public_access_in line 17 extended permit tcp any object Private_IP_1.20_http
object-group Obj-Service_http
!
nat (HQ_LAN,PUBLIC) source static Private_IP_1.20_http Public_IP_197 destination static Public_IP_197 Private_IP_1.20_http

!
!

PORT 443

object-group network Public_IP_199
description Public_IP
network-object host 194.75.244.199
!
object network Private_IP_1.23_https
description Private_IP SSL Intranet
host 172.16.1.23
nat (HQ_LAN,PUBLIC) static Public_IP_199 service tcp 443 443
!
!
access-list Public_access_in line 18 remark SSL_Intranet
access-list Public_access_in line 19 extended permit tcp any object Private_IP_1.23_https
object-group Obj-Service_https
!
nat (HQ_LAN,PUBLIC) source static Private_IP_1.23_https Public_IP_199 destination static Public_IP_199 Private_IP_1.23_https

PORT 80

object network Private_IP_1.23_http
description Private_IP Intranet
host 172.16.1.23
nat (HQ_LAN,PUBLIC) static Public_IP_199 service tcp 80 80
!
!
access-list Public_access_in line 20 remark HTTP_Intranet
access-list Public_access_in line 21 extended permit tcp any object Private_IP_1.23_http
object-group Obj-Service_http
!
nat (HQ_LAN,PUBLIC) source static Private_IP_1.23_http Public_IP_199 destination static Public_IP_199 Private_IP_1.23_http

!
!

PORT 25

object-group network Public_IP_200
description Public_IP
network-object host 194.75.244.200
!
object network Private_IP_1.26_smtp
description Private_IP Sophos Mail Filter
host 172.16.1.26
nat (HQ_LAN,PUBLIC) static Public_IP_200 service tcp smtp smtp
!
object service Obj-Service_smtp
service tcp destination eq smtp
!
object-group service Obj-Service_sophos tcp
port-object eq smtp
port-object eq 143
port-object eq 110
port-object eq 80
!
access-list Public_access_in line 22 remark Sophos_Mail_Filter
access-list Public_access_in line 23 extended permit tcp any object Private_IP_1.26_smtp object-group Obj-Service_sophos
!
nat (HQ_LAN,PUBLIC) source dynamic Private_IP_1.26_smtp Public_IP_200 destination static Public_IP_200 Public_IP_200 service Obj-Service_smtp Obj-Service_smtp

PORT 80

object network Private_IP_1.26_http
description Private_IP Sophos Mail Filter
host 172.16.1.26
nat (HQ_LAN,PUBLIC) static Public_IP_200 service tcp 80 80
!
!
nat (HQ_LAN,PUBLIC) source static Private_IP_1.26_http Public_IP_200 destination static Public_IP_200 Private_IP_1.26_http

PORT 143

object network Private_IP_1.26_imap
description Private_IP Sophos Mail Filter
host 172.16.1.26
nat (HQ_LAN,PUBLIC) static Public_IP_200 service tcp 143 143
!
object-group service Obj-Service_imap tcp
port-object eq 143
!
!
nat (HQ_LAN,PUBLIC) source static Private_IP_1.26_imap Public_IP_200 destination static Public_IP_200 Private_IP_1.26_imap

PORT 110

object network Private_IP_1.26_pop3
description Private_IP Sophos Mail Filter
host 172.16.1.26
nat (HQ_LAN,PUBLIC) static Public_IP_200 service tcp 110 110
!
object-group service Obj-Service_pop3 tcp
port-object eq 110
!
!
nat (HQ_LAN,PUBLIC) source static Private_IP_1.26_pop3 Public_IP_200 destination static Public_IP_200 Private_IP_1.26_pop3

!
!

packet-tracer input HQ_LAN tcp 172.16.1.26 25 194.75.244.200 25

July 28, 2011 2:47 pm

Cisco ASA

(Permalink)

No comments yet.

Tags: asa static nat

by admin

ASA 8.3(x) Dynamic PAT with Two Internal Networks and Internet Configuration

Requirements

Ensure that you meet these requirements before you attempt this configuration:

Make sure the internal network has two networks located on the inside of the ASA:
- 192.168.0.0/24—Network directly connected to the ASA.
- 192.168.1.0/24—Network on the inside of the ASA, but behind another device (for example, a router).
Make sure the internal users get PAT as follows:
- Hosts on the 192.168.1.0/24 subnet will get PAT to a spare IP address given by the ISP (10.1.5.5).
- Any other host behind the inside of the ASA will get PAT to the outside interface IP address of the ASA (10.1.5.1).

Components Used

The information in this document is based on these software and hardware versions:

Cisco Adaptive Security Appliance (ASA) with version 8.3(1)
ASDM version 6.3(1)

ASA CLI Configuration

This document uses the configurations shown below.

ASA Dynamic PAT Configuration
ASA#configure terminal Enter configuration commands, one per line. End with CNTL/Z. !--- Creates an object called OBJ_GENERIC_ALL. !--- Any host IP not already matching another configured !--- object will get PAT to the outside interface IP !--- on the ASA (or 10.1.5.1), for internet bound traffic. ASA(config)#object network OBJ_GENERIC_ALL ASA(config-obj)#subnet 0.0.0.0 0.0.0.0 ASA(config-obj)#exit ASA(config)#nat (inside,outside) source dynamic OBJ_GENERIC_ALL interface !--- The above statements are the equivalent of the !--- nat/global combination (as shown below) in v7.0(x), !--- v7.1(x), v7.2(x), v8.0(x), v8.1(x) and v8.2(x) ASA code: nat (inside) 1 0.0.0.0 0.0.0.0 global (outside) 1 interface !--- Creates an object called OBJ_SPECIFIC_192-168-1-0. !--- Any host IP facing the the ‘inside’ interface of the ASA !--- with an address in the 192.168.1.0/24 subnet will get PAT !--- to the 10.1.5.5 address, for internet bound traffic. ASA(config)#object network OBJ_SPECIFIC_192-168-1-0 ASA(config-obj)#subnet 192.168.1.0 255.255.255.0 ASA(config-obj)#exit ASA(config)#nat (inside,outside) source dynamic OBJ_SPECIFIC_192-168-1-0 10.1.5.5 !--- The above statements are the equivalent of the nat/global !--- combination (as shown below) in v7.0(x), v7.1(x), v7.2(x), v8.0(x), !--- v8.1(x) and v8.2(x) ASA code: nat (inside) 2 192.168.1.0 255.255.255.0 global (outside) 2 10.1.5.5

ASA Dynamic PAT Configuration

ASA#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.


!--- Creates an object called OBJ_GENERIC_ALL.
!--- Any host IP not already matching another configured
!--- object will get PAT to the outside interface IP
!--- on the ASA (or 10.1.5.1), for internet bound traffic.


ASA(config)#object network OBJ_GENERIC_ALL
ASA(config-obj)#subnet 0.0.0.0 0.0.0.0
ASA(config-obj)#exit
ASA(config)#nat (inside,outside) source dynamic OBJ_GENERIC_ALL interface


!--- The above statements are the equivalent of the
!--- nat/global combination (as shown below) in v7.0(x),
!--- v7.1(x), v7.2(x), v8.0(x), v8.1(x) and v8.2(x) ASA code:


nat (inside) 1 0.0.0.0 0.0.0.0
global (outside) 1 interface



!--- Creates an object called OBJ_SPECIFIC_192-168-1-0.
!--- Any host IP facing the the ‘inside’ interface of the ASA
!--- with an address in the 192.168.1.0/24 subnet will get PAT
!--- to the 10.1.5.5 address, for internet bound traffic.


ASA(config)#object network OBJ_SPECIFIC_192-168-1-0
ASA(config-obj)#subnet 192.168.1.0 255.255.255.0
ASA(config-obj)#exit
ASA(config)#nat (inside,outside) source dynamic OBJ_SPECIFIC_192-168-1-0 10.1.5.5


!--- The above statements are the equivalent of the nat/global
!--- combination (as shown below) in v7.0(x), v7.1(x), v7.2(x), v8.0(x),
!--- v8.1(x) and v8.2(x) ASA code:


nat (inside) 2 192.168.1.0 255.255.255.0
global (outside) 2 10.1.5.5

ASA 8.3(1) Running Config
ASA Version 8.3(1) ! hostname ASA 1 names ! !--- Configure the outside interface. ! interface GigabitEthernet0/0 nameif outside security-level 0 ip address 10.1.5.1 255.255.255.0 !--- Configure the inside interface. ! interface GigabitEthernet0/1 nameif inside security-level 100 ip address 192.168.0.1 255.255.255.0 ! ! boot system disk0:/asa831-k8.bin ! ! object network OBJ_SPECIFIC_192-168-1-0 subnet 192.168.1.0 255.255.255.0 object network OBJ_GENERIC_ALL subnet 0.0.0.0 0.0.0.0 ! nat (inside,outside) source dynamic OBJ_GENERIC_ALL interface nat (inside,outside) source dynamic OBJ_SPECIFIC_192-168-1-0 10.1.5.5

ASA 8.3(1) Running Config

ASA Version 8.3(1)
!
hostname ASA
1
names
!

!--- Configure the outside interface.

!
interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address 10.1.5.1 255.255.255.0

!--- Configure the inside interface.

!
interface GigabitEthernet0/1
 nameif inside
 security-level 100
 ip address 192.168.0.1 255.255.255.0 
!
!
boot system disk0:/asa831-k8.bin
!
!
object network OBJ_SPECIFIC_192-168-1-0 
 subnet 192.168.1.0 255.255.255.0
object network OBJ_GENERIC_ALL 
 subnet 0.0.0.0 0.0.0.0
!
nat (inside,outside) source dynamic OBJ_GENERIC_ALL interface
nat (inside,outside) source dynamic OBJ_SPECIFIC_192-168-1-0 10.1.5.5