Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have an ASA configured as follows;

Inside: 192.168.0.254/24 Outside: 10.0.0.1/29 (This is routed to the ASA)

global (outside) 1 interface
global (outside) 2 10.0.0.2
nat (inside) 1 0.0.0.0 0.0.0.0
nat (inside) 2 192.168.0.50 255.255.255.255

static (inside,outside) 10.0.0.2 192.168.0.5 netmask 255.255.255.255

As you can see, there is a default NAT rule to NAT clients to the external IP on their way out. There is also a specific rule to map internal host 192.168.0.50/32 to 10.0.0.2, a different external IP. Finally there is a static mapping for 10.0.0.2 at the end.

I am trying to enter the following static NAT rule to port forward on the external IP 10.0.0.1 to internal host 192.168.0.5;

# static (inside,outside) tcp interface 555 192.168.0.5 555 netmask 255.255.255.255
ERROR: duplicate of existing static
  inside:192.168.0.5 to outside:10.0.0.2 netmask 255.255.255.255

I don't understand what's going on here. Can someone explain please?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

The static command works both ways: traffic coming for 10.0.0.2 is translated to 192.168.0.5 and traffic from 192.168.0.5 is translated from 10.0.0.2 . You can not map 192.168.0.5 to another address on the outside interface, such as 10.0.0.2 .

You can use the nat command with acl in order to forward specific ports on specific addresses.

For example if you want that outgoing smtp traffic from 192.168.0.5 to be seen as from 10.0.0.2 ( source nat for outgoing traffic ):

access-list outfrom_10.0.0.2   extended permit tcp host 192.168.0.5 any eq smtp
nat (inside) 2 access-list outfrom_10.0.0.2

And then if you want that incoming http traffic to 10.0.0.1 to be forwarded to 192.168.0.5 you can add this

static (inside,outside) tcp 10.0.0.1 http 192.168.0.5 http netmask 255.255.255.255

( of course you have to remove the existing static (inside,outside) 10.0.0.2 192.168.0.5 netmask 255.255.255.255 )

share|improve this answer
    
With the static NAT rule I have, my understanding is that it will make a 1:1 NAT of 192.168.0.5 to external IP 10.0.0.2. So, if I wanted to forward a single port on external IP 10.0.0.1 to 192.168.0.5 this wouldn't work, because the return traffic would go out as 10.0.0.2 and the remote machine wouldn't recognise this return traffic. Is that correct, I assume the ASA wouldn't track that the traffic came in on 10.0.0.1 and not 10.0.0.2 and so won't send it back out as 10.0.0.1? –  jwbensley Jan 30 '12 at 11:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.