Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an ASA configured as follows;

Inside: Outside: (This is routed to the ASA)

global (outside) 1 interface
global (outside) 2
nat (inside) 1
nat (inside) 2

static (inside,outside) netmask

As you can see, there is a default NAT rule to NAT clients to the external IP on their way out. There is also a specific rule to map internal host to, a different external IP. Finally there is a static mapping for at the end.

I am trying to enter the following static NAT rule to port forward on the external IP to internal host;

# static (inside,outside) tcp interface 555 555 netmask
ERROR: duplicate of existing static
  inside: to outside: netmask

I don't understand what's going on here. Can someone explain please?

share|improve this question
up vote 3 down vote accepted

The static command works both ways: traffic coming for is translated to and traffic from is translated from . You can not map to another address on the outside interface, such as .

You can use the nat command with acl in order to forward specific ports on specific addresses.

For example if you want that outgoing smtp traffic from to be seen as from ( source nat for outgoing traffic ):

access-list outfrom_10.0.0.2   extended permit tcp host any eq smtp
nat (inside) 2 access-list outfrom_10.0.0.2

And then if you want that incoming http traffic to to be forwarded to you can add this

static (inside,outside) tcp http http netmask

( of course you have to remove the existing static (inside,outside) netmask )

share|improve this answer
With the static NAT rule I have, my understanding is that it will make a 1:1 NAT of to external IP So, if I wanted to forward a single port on external IP to this wouldn't work, because the return traffic would go out as and the remote machine wouldn't recognise this return traffic. Is that correct, I assume the ASA wouldn't track that the traffic came in on and not and so won't send it back out as – jwbensley Jan 30 '12 at 11:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.