I'm trying to setup a NAT / PAT in ASA 5520, I'm able to do so very well when the Public IP I want translated to Internal host is configured on the Outside.

Question is the ISP provided for the Outside interface and an extra for use as extra public IPs.

On the old Cisco Router those IPs don't need to be configured on any interface just added as regular NAT entries and that would work.

I've tried added a static NAT but there is not even possibility to do it by port.

The goal would be -> Any advice how that can be accomplished?


1 Answer 1


Yes, you can certainly configure a Static PAT on a Cisco ASA. Typically this is done using AutoNAT:

Within an object definition, this is the syntax you would use:

nat (<REAL-INTF>, <MAPPED-INTF>) static <MAPPED-IP> [service <tcp|udp> <REAL-PORT> <MAPPED-PORT>]

There is also a way to do it with Manual NAT syntax, but that is genearlly only required if you have particular NAT precedence concerns, or if you are trying to configure it conditionally (i.e., based upon both the source and destination of traffic -- otherwise known as a Policy NAT).

Example: Cisco ASA NAT Configuration Guide - Static PAT

To configure that, you would use this syntax:

object network WEB41-www
  nat (inside,outside) static service tcp 8080 80

object network WEB42-https
  nat (inside,outside) static service tcp 443 443

Image and examples are from this article:


(Disclaimer: I wrote the article. There are no ads. It is 100% free. Hope it helps).

  • 1
    Perfect, exactly the way I intended. Thanks
    – rgomez
    Commented Mar 11, 2020 at 22:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.