ASA 8.3 and up greatly changed NAT in the ASA OS.
If you are defining the NAT behavior in object configuration mode (inside an object), it is called object NAT. If you are defining the NAT behavior in global configuration mode, it is called twice NAT. Be sure to read the 8.4 CLI Guide Sections on NAT
In object NAT, only a single NAT statement can be used per object. As such, if you want to implement static PAT (port forwarding in layman's terms) you will need to create an object for each port to be forwarded -- whether it is to the same internal host or to different internal hosts.
Below is an outline for how I configure static PAT. The process for static NAT is the same, but omits step 2.
Create a host object
for the inside/internal host. Do not use a nat
statement on this object
if this host will be used for static PAT. (In the case of static NAT, a nat
statement should be used on this object.)
Create another host object
to be used for each static PAT to the inside host. Naming is important as a nat
statement will be on this object. Use a nat
statement on this object to forward the port/service.
Create an object-group
of type service
for all of the "ports/services" that are forwarded/permitted in to the inside/internal host. This object-group
is not used for NAT/PAT purposes, but for the ACL later on.
With the NAT (static PAT) rule defined in the object
, put ACL requirement together in an access-list
.
Below is an example that includes the following from your own example:
- Static PAT two services from one outside IP to two inside IP's/hosts.
- Static PAT two services from one outside IP to one inside IP/host.
- (Added) Static NAT from one outside IP to one inside IP/host with ACL permit 5 services.
Example:
object network hst-192.168.1.5
host 192.168.1.5
description Server1 Host Object
object network hst-192.168.1.5-tcp85
host 192.168.1.5
description Server1 TCP/85 Static PAT Object
nat (inside,outside) static 5.5.5.5 service tcp 85 85
object network hst-192.168.1.9
host 192.168.1.9
description Server2 Host Object
object network hst-192.168.1.9-tcp33
host 192.168.1.9
description Server2 TCP/33 Static PAT Object
nat (inside,outside) static 5.5.5.5 service tcp 33 33
object network hst-192.168.1.20
host 192.168.1.20
description Server3 Host Object
object network hst-192.168.1.20-tcp80
host 192.168.1.20
description Server3 TCP/80 Static PAT Object
nat (inside,outside) static 6.6.6.6 service tcp 80 80
object network hst-192.168.1.20-tcp443
host 192.168.1.20
description Server3 TCP/443 Static PAT Object
nat (inside,outside) static 6.6.6.6 service tcp 443 443
object network hst-192.168.1.30
host 192.168.1.30
description Server4 Host Object (and Static NAT)
nat (inside,outside) static 7.7.7.7
object-group service svcgrp-192.168.1.5-tcp tcp
port-object eq 85
object-group service svcgrp-192.168.1.9-tcp tcp
port-object eq 33
object-group service svcgrp-192.168.1.9-tcp tcp
port-object eq 80
port-object eq 443
object-group service svcgrp-192.168.1.30-tcp tcp
port-object eq 20
port-object eq 21
port-object eq 22
port-object eq 80
port-object eq 443
access-list outside_access_in extended permit tcp any object hst-192.168.1.5 object-group svcgrp-192.168.1.5-tcp
access-list outside_access_in extended permit tcp any object hst-192.168.1.9 object-group svcgrp-192.168.1.9-tcp
access-list outside_access_in extended permit tcp any object hst-192.168.1.20 object-group svcgrp-192.168.1.20-tcp
access-list outside_access_in extended permit tcp any object hst-192.168.1.30 object-group svcgrp-192.168.1.30-tcp
access-group outside_access_in in interface outside
What you can take away from the example (and the new NAT style in general) is the following:
- Static PAT seems a little more involved than it should be -- especially when it comes to forwarding in many different services/ports.
- Static NAT -- in network object mode is much simpler. If fully using objects (for both hosts and service groups) -- "permitting" more ports can be as simple as adding an entry to the service group.
- Use Static NAT whenever possible due to its simplicity.
- If you don't have a naming convention/standard -- your configuration will get out of control and difficult to read very quickly.