1

I am trying to setup a load balancer behind my ASA 5515. (Running Cisco IOS version 9.1.)

Is it possible to group the ports to do a static nat, with a service-group statement? For instance, I want to be able to NAT ports 80 and 443 (and other ports).

My service group:

object-group service webServices
   service-object tcp destination eq www 
   service-object tcp destination eq https

My network object:

object network lb01
   host 192.168.1.13

My hopeful nat statement (which fails woefully):

nat (dmz,outside) static interface service tcp object-group webServices object-group webServices

Please can someone correct me? Thanks a lot!

Improve this question

1 Answer 1

Reset to default
1

I think I fixed it. Final configuration (though the ASA complained a few times about overlap) is

object network lb01
  host 192.168.72.11

object-group service webServices
 service-object tcp destination eq www 
 service-object tcp destination eq https

object network lb01
 nat (dmz,outside) static interface


access-list outside_in extended permit object-group webServices any object lb01

It works and only the ports in the service group get NAT'ed.

Improve this answer
2
  • You should accept your answer so that the question doesn't keep popping up forever, looking for an answer.
    – Ron Maupin ♦
    Commented Mar 31, 2016 at 15:03
  • I tried before but it told me I can't accept until 2 days.
    – Unpossible
    Commented Mar 31, 2016 at 16:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.