Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Using a cisco ASA device with an external IP of 200.20.20.20 (interface OUTSIDE) and an internal subnet of 10.1.1.1/24 (interface INSIDE), how can I configure the ASA so that all traffic to a specific port on the external interface gets directed to an internal server (and the response is returned)

For example, if an external user connects to 200.20.20.20:5000 I want it redirected to 10.1.1.27:8080;

share|improve this question

1 Answer 1

up vote 6 down vote accepted

TO get this working you will need to setup a static nat, and add to the access-list to allow the traffic once. (NAT happens before access-list: Details of Order of operations)

Static NAT

Static NAT's on cisco have always been weird (for me at least). Basic thing to remember is (HIGH,LOW) LOW, HIGH for this command.

static (inside,outside) tcp 200.20.20.20 5000 10.1.1.27 8080 netmask 255.255.255.255 0 0

ACLs

This acl will need to be applied to what ever you have named your access-list attached to OUTSIDE interface. (Change: *outside_acl* )

access-list outside_acl extended permit tcp any host 10.1.1.27 eq 8080

Disclaimer

Sorry I don't have my test ASA in front of me, but this should be very close.

share|improve this answer
    
spot-on; I just set the Static NAT, confirmed that packets were then being rejected by the ACLs, and tweaked the ACL. –  DrStalker Aug 14 '09 at 5:31
    
Glad I could help - Have a good day/night –  Jeremy Rossi Aug 14 '09 at 7:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.