Trying to set up external FTPS access for a web server we have hosted here. I added the rule to the inbound access-list to allow it through. But I believe I would also need to set up a PAT rule to translate the requests coming in on the external IP to the internal IP of the server?

So requests on EXTERNALIP:990 would need to translated to INTERNALIP:990 correct?

How would this be done from the CLI on a ASA 5510?

  • A few questions for clarification - 1. What code version are you running? (NAT configuration changes pre and post 8.3) 2. Is the web server sharing an External/Public IP with other devices?
    – dareuja
    Jan 18 '16 at 0:47
  • We are on version 8.4, and the external IP just points to the one site hosted on that web server. Jan 19 '16 at 13:52
  • So mydomain.com points to EXTERNALIP which points to an internal server hosting the site on 80/443. Would also like to be able to use mydomain.com:990 for the FTPS connection as well, is that possible? Jan 19 '16 at 15:09
  • PAT is really made up. The RFCs use NAPT for what some people call PAT. See RFC 2663, IP Network Address Translator (NAT) Terminology and Considerations, Section 4.1.2 Network Address Port Translation (NAPT): "NAPT extends the notion of translation one step further by also translating transport identifier (e.g., TCP and UDP port numbers, ICMP query identifiers). This allows the transport identifiers of a number of private hosts to be multiplexed into the transport identifiers of a single external address." There is more in the RFC.
    – Ron Maupin
    Jan 30 '17 at 15:51

My apologies for the late response, I've been AFK due to life issues. You have probably already got this working.

As long as your NAT statement translates ExternalIp to InternalIp without port requirements, you should be fine using port 990 on the same server for FTPS.

If you are using a static NAT similar to the below, port requirements would only need to be taken in consideration for ACLs:

object network WEB-SVR
nat (DMZ,outside) static

The only thing to be careful of is to be sure to allow the required access through the firewall ACLs as there is most likely a port range configured for the service that will need to be allowed.

Thank you and take care,

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.