1

for example I want to:

 NAT 5.5.5.5 tcp 85 to 192.168.1.5 tcp 85
 NAT 5.5.5.5 tcp 33 to 192.168.1.9 tcp 33
 NAT 6.6.6.6 tcp 80 443 to 192.168.1.20 tcp 80 443

The way I was going to do this was:

object obj-192.168.1.5
host 192.168.1.5
nat (inside,outside) static 5.5.5.5 service tcp 85 85

object obj-192.168.1.9
host 192.168.1.9
nat (inside,outside) static 5.5.5.5 service tcp 33 33

object obj-192.168.1.20
host 192.168.1.9
nat (inside,outside) static 6.6.6.6. ????

Then add an ACL to allow the traffic in. I don't know how to make a service group and apply that to the NAT, it seems to only allow you to enter one port at a time.

Any idea how to do this?

2 Answers 2

2

ASA 8.3 and up greatly changed NAT in the ASA OS.

If you are defining the NAT behavior in object configuration mode (inside an object), it is called object NAT. If you are defining the NAT behavior in global configuration mode, it is called twice NAT. Be sure to read the 8.4 CLI Guide Sections on NAT

In object NAT, only a single NAT statement can be used per object. As such, if you want to implement static PAT (port forwarding in layman's terms) you will need to create an object for each port to be forwarded -- whether it is to the same internal host or to different internal hosts.

Below is an outline for how I configure static PAT. The process for static NAT is the same, but omits step 2.

  1. Create a host object for the inside/internal host. Do not use a nat statement on this object if this host will be used for static PAT. (In the case of static NAT, a nat statement should be used on this object.)

  2. Create another host object to be used for each static PAT to the inside host. Naming is important as a nat statement will be on this object. Use a nat statement on this object to forward the port/service.

  3. Create an object-group of type service for all of the "ports/services" that are forwarded/permitted in to the inside/internal host. This object-group is not used for NAT/PAT purposes, but for the ACL later on.

  4. With the NAT (static PAT) rule defined in the object, put ACL requirement together in an access-list.

Below is an example that includes the following from your own example:

  • Static PAT two services from one outside IP to two inside IP's/hosts.
  • Static PAT two services from one outside IP to one inside IP/host.
  • (Added) Static NAT from one outside IP to one inside IP/host with ACL permit 5 services.

Example:

object network hst-192.168.1.5
 host 192.168.1.5
 description Server1 Host Object

object network hst-192.168.1.5-tcp85
 host 192.168.1.5
 description Server1 TCP/85 Static PAT Object
 nat (inside,outside) static 5.5.5.5 service tcp 85 85

object network hst-192.168.1.9
 host 192.168.1.9
 description Server2 Host Object

object network hst-192.168.1.9-tcp33
 host 192.168.1.9
 description Server2 TCP/33 Static PAT Object
 nat (inside,outside) static 5.5.5.5 service tcp 33 33

object network hst-192.168.1.20
 host 192.168.1.20
 description Server3 Host Object

object network hst-192.168.1.20-tcp80
 host 192.168.1.20
 description Server3 TCP/80 Static PAT Object
 nat (inside,outside) static 6.6.6.6 service tcp 80 80

object network hst-192.168.1.20-tcp443
 host 192.168.1.20
 description Server3 TCP/443 Static PAT Object
 nat (inside,outside) static 6.6.6.6 service tcp 443 443

object network hst-192.168.1.30
 host 192.168.1.30
 description Server4 Host Object (and Static NAT)
 nat (inside,outside) static 7.7.7.7

object-group service svcgrp-192.168.1.5-tcp tcp
 port-object eq 85

object-group service svcgrp-192.168.1.9-tcp tcp
 port-object eq 33

object-group service svcgrp-192.168.1.9-tcp tcp
 port-object eq 80
 port-object eq 443

object-group service svcgrp-192.168.1.30-tcp tcp
 port-object eq 20
 port-object eq 21
 port-object eq 22
 port-object eq 80
 port-object eq 443

access-list outside_access_in extended permit tcp any object hst-192.168.1.5 object-group svcgrp-192.168.1.5-tcp
access-list outside_access_in extended permit tcp any object hst-192.168.1.9 object-group svcgrp-192.168.1.9-tcp
access-list outside_access_in extended permit tcp any object hst-192.168.1.20 object-group svcgrp-192.168.1.20-tcp
access-list outside_access_in extended permit tcp any object hst-192.168.1.30 object-group svcgrp-192.168.1.30-tcp

access-group outside_access_in in interface outside

What you can take away from the example (and the new NAT style in general) is the following:

  • Static PAT seems a little more involved than it should be -- especially when it comes to forwarding in many different services/ports.
  • Static NAT -- in network object mode is much simpler. If fully using objects (for both hosts and service groups) -- "permitting" more ports can be as simple as adding an entry to the service group.
  • Use Static NAT whenever possible due to its simplicity.
  • If you don't have a naming convention/standard -- your configuration will get out of control and difficult to read very quickly.
2

Each 'nat' line can only be used for a single port or all ports (any). To do the translation of two ports requires two lines.

object obj-192.168.1.20
host 192.168.1.9
nat (inside,outside) static 6.6.6.6 service tcp 80 80
nat (inside,outside) static 6.6.6.6 service tcp 443 443
4
  • gotcha, well that answers that question about multiple ports for the NAT. Am I doing the NAT'ing correctly for the 1 external to 2 inside host?
    – evolvd
    Feb 10, 2012 at 18:26
  • 1
    When translating ports, it is always 1 external host:port to 1 inside host:port. You can use the same external or inside host as many times as you like in whatever combination you like as long as the ports are different. The entries you have look fine.
    – Justin
    Feb 10, 2012 at 18:54
  • Well it turns out you can only have one nat statement per object. How do I get around this?
    – evolvd
    Feb 10, 2012 at 22:42
  • @Justin In network object NAT, only a single nat statement can be used per object. The example you have provided will result in the last nat statement overwriting the first. My answer contains one possible correct solution.
    – Weaver
    Feb 12, 2012 at 23:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .