Cisco ASA 5508-X, Configuration Manual

Page: 209 / 428

10-5
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 10 NAT Examples and Reference
Examples for Network Object NAT
Single Address for FTP, HTTP, and SMTP (Static NAT-with-Port-Translation)
The following static NAT-with-port-translation example provides a single address for remote users to
access FTP, HTTP, and SMTP. These servers are actually different devices on the real network, but for
each server, you can specify static NAT-with-port-translation rules that use the same mapped IP address,
but different ports.
Figure 10-4 Static NAT-with-Port-Translation
Procedure
Step 1
Create a network object for the FTP server and configure static NAT with port translation, mapping the
FTP port to itself.
hostname(config)# object network FTP_SERVER
hostname(config-network-object)#
host 10.1.2.27
hostname(config-network-object)# nat (inside,outside) static 209.165.201.3 service tcp ftp
ftp
Step 2 Create a network object for the HTTP server and configure static NAT with port translation, mapping
the HTTP port to itself.
hostname(config)# object network HTTP_SERVER
hostname(config-network-object)# host 10.1.2.28
hostname(config-network-object)# nat (inside,outside) static 209.165.201.3 service tcp
http http
Step 3
Create a network object for the SMTP server and configure static NAT with port translation, mapping
the SMTP port to itself.
Ho s t
O u t s ide
In s ide
Undo Tr a n s l a tion
10.1.2.27 209.165.201.3:21
Undo Tr a n s l a tion
10.1.2.28 209.165.201.3:80
Undo Tr a n s l a tion
10.1.2.29 209.165.201.3:25
FTP s erver
10.1.2.27
HTTP s erver
10.1.2.28
S MTP s erver
10.1.2.29
130031