2

We have a Cisco ASA 5515 and I am having trouble setting up the proper NAT rule to route a group of services from a public ip (which is already routing some single ports) to an internal ip. I am using ASDM to configure but I exported the pertinent parts to command line.

    object network IP_147
     host xxx.xxx.xxx.147
    object network Scomage-ESET
     host 10.10.100.11

    object service RDP
     service tcp destination eq 3389 
    object service ESET_2222_2223
     service tcp destination range 2222 2223 
    object service ESET_3128
     service tcp destination eq 3128 
    object service ESET_8443
     service tcp destination eq 8443 
    object-group service ESET
     service-object tcp destination eq https 
     service-object object ESET_2222_2223 
     service-object object ESET_3128 
     service-object object ESET_8443 

    access-list outside_access_in extended permit object RDP any object Scomage-CPC21 
    access-list outside_access_in extended permit object RDP any object Scomage-CPC22 
    access-list outside_access_in extended permit object RDP any object Scomage-CPC23 
    access-list outside_access_in extended permit object-group ESET any object Scomage-ESET 

    object network Scomage-CPC21
     nat (inside,outside) static IP_147 service tcp 3389 9401 
    object network Scomage-CPC22
     nat (inside,outside) static IP_147 service tcp 3389 9402 
    object network Scomage-CPC23
     nat (inside,outside) static IP_147 service tcp 3389 9403

IP_147 is the external ip I want to use for this access. Currently 9401, 9402, and 9403 route to specific internal machines port 3389. This works just fine. Unfortunately ASDM won't let me put in a group. Do I have to do it in command line? How is this best done?

Improve this question
6
  • Are you saying you want a request to TCP/9401 to translate to TCP/3389 on Scomage-CPC21, TCP/9402 to TCP/3389 on Scomage-CPC22, etc? I don't understand what you mean about wanting to group them. What would your goal be for grouping them?
    – Jesse P.
    Feb 7, 2021 at 2:16
  • In your example, you cann't group NAT rule
    – Igor
    Feb 7, 2021 at 16:19
  • No. The three rules to route rdp are working fine. I wanted to do the same thing with a service group ESET routed to Scomage-ESET.
    – Jerry Welliver
    Feb 7, 2021 at 17:26
  • I want to send any traffic on ports 2222,2223,3128,8443 coming in on IP_147 to Scomage_ESET. No port translation is required.
    – Jerry Welliver
    Feb 7, 2021 at 17:34
  • Thanks Jesse. The cli solution will be great. I have been comparing the two against each other and I should be able to figure it out.
    – Jerry Welliver
    Feb 7, 2021 at 19:53

1 Answer 1

Reset to default
2

So, as I said, you can mostly accomplish what you want (minus an actual object-group to reference in a single NAT statement).

You'll need to create multiple objects all pointed to the same host IP address, but named differently; this will allow you to map multiple ports to the same host without mapping ALL ports and protocols to said host (it will only map the specific ports/protocols).

So, you can add:

object network Scomage-ESET-2222
 host 10.10.100.11
 nat (inside,outside) static IP_147 service tcp 2222 2222
!
object network Scomage-ESET-2223
 host 10.10.100.11
 nat (inside,outside) static IP_147 service tcp 2223 2223
!
object network Scomage-ESET-3128
 host 10.10.100.11
 nat (inside,outside) static IP_147 service tcp 3128 3128
!
object network Scomage-ESET-8443
 host 10.10.100.11
 nat (inside,outside) static IP_147 service tcp 8443 8443
!
Improve this answer
2
  • I wondered if this was the way it had to be done! Seems strange that a service group is not allowed. Even the lowly SonicWall firewalls can do that! Thanks for the clarification. :)
    – Jerry Welliver
    Feb 8, 2021 at 2:09
  • @JerryWelliver I know. ASAs are pretty much a standout with this. Just about every other brand I work with can do it. I'll have to look again but, I think FXOS can do it too, and that it's just the ASA OS that can't
    – Jesse P.
    Feb 8, 2021 at 2:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.