From single to multiple IP addresses external IP traffic internal

We are transitioning to a Symantec SMS to a Cisco ASA 5505, and I'm running into a lot of trouble to replicate our configuration for inbound traffic. We currently have a Setup something like this:

(Of course I pick up a bunch of arbitrary numbers here.)

1.2.3.4 port one--> 10.1.0.1 port one

1.2.3.4 port b--> 10.1.0.5 port b

1.2.3.4 port x--> 10.1.0.20 port p

1.2.3.4 port is--> 10.1.0.21 p port

1.2.3.4 port z--> 10.1.0.22 p port

1.2.3.4 is the unique external IP address we use for traffic that passes through, and 10.1.0.x internal host. x, y and z are ports chosen arbitrarily in a sequence.

I'm doing it via the ASDM. The ASA is running 9.1 2 software and I use ASDM 7.1 (3). I'm trying to accomplish this by using Configuration > firewall > public servers.

What I do is the following:

  1. In Configuration > firewall > objects > network objects/groups, create objects for the external IP address and all internal hosts.
  2. In Configuration > firewall > objects > objects/Service groups, create objects TCP ports x y z, and a TCP object for p port (which is not in the default set). Protocols on ports a and b are in the game by default, so they do not need to be defined.
  3. In Configuration > firewall > public servers, add a series of entries of public server with the external host as public IP, address the external interface as the public Interface, the internal as the private Interface interface, the host in question as IP address private, and in the case the two first entries, the protocol chosen as the private service sector. In the case of the last of three entries, I also selects "public address specify if it is different from the private Service. This will allow the static PAT. "I then selects the associated service from port p as the private Service and the service associated with the ports x, y or z (respectively) in the public service.

.. .or at least, that's what I'm trying to do. I have encountered the following problems:

  1. If I do not use 'Specify the public address if different of the private service', the first mapping I do works very well and pass the traffic correctly. If I do, it does not. (I'm testing it trying to connect from the outside and I get a connection in the case of the former, but not in the latter scenario.) I generally choose tcp/aol as my test "public service" and are trying to connect to the external IP address on port 5190, which is the port for tcp/aol.)
  2. At the time wherever I try to do a second mapping, the system rejects saying «server address configuration comes into conflict with a rule of existing translation»
  3. Even if it worked, when I select "Public address specify if it is different from the private service", it only shows me the list of integrated service objects, not everything I've created. This isn't really the end of the world - I could divert just a series of services that we do not - but it would be nice if I could get actually ports my users are already using so that I could make a transparent exchange rather than giving them all the new connection information.

Any thoughts would be greatly appreciated. I guess I'm missing something pretty obvious, but I'm not that knowledgeable about the Cisco ASA family at this point, I can probably use a few pointers get this working.

Thank you!

Hello

There's something really weird happens with the end of your post. The second section of numbered points has its text completely messed. The lines of text are on top of eachother.

I don't personally use the ASDM at all to configure ACL and NAT configurations.

I could help with the configuration of CLI format however.

Seems that you are trying to configure static PAT (Port Forwarding) for several internal hosts using the public IP address unique who will be on the external interface of the ASA.

In general, you can use this format for all NAT configurations

network of the object

host

NAT tcp service interface static (inside, outside)

Naturally, the names of the interface may be different and could be "udp" instead of "tcp". Also since you can configure a large number of these I suggest you come up with a clear policy naming for your 'network of the object' so that they are easy to read and to clarify the purpose.

Each 'object' that is created can be used on your external interface ACL to allow traffic. However if you want to configure a large number of these configurations PAT static and there are several ports for host even then it might be easier to make different 'object' to be used in the ACL list or it can be annoying.

Could resemble a basic ACL corresponding to the "nat" above configuration rule

access list permit tcp any eq object

Once again the ACL above may look different in your use. You can limit the traffic of certain source addresses that would mean multiple ACL lines.

Hope this helps

-Jouni

Tags: Cisco Security

Similar Questions

  • How do I upgrade from single to multiple license?

    Should not be this hard to find, but I have a problem! Where can I see the prices and the upgrade? Right now I have a license (2 computers), but I need to add one or two more. Thanks in advance!

    Hello

    Looks like you would be interested in the upgrade from an individual membership of creative cloud to a member of the team. We currently have an introductory offer for creative cloud for teams.

    You can learn more about the teams here:

    http://www.Adobe.com/products/creativecloud/teams.html

    Note the Save $20 US/month offer launch for existing customers of CS.

    The transition, to contact our customer service to cancel your current subscription and get setup with the team.

    WE

    800-833-6687.

    Monday to Friday, from 05:00 - 19: 00 PST

    Hope that helps,

    -Dave

  • Multiple firewall RV042 external IP addresses

    Hi, I hope someone can give me an example of what I need to do, if possible with the RV042

    Main uses of IP address external port forward for some ports, all OK.

    I would like to have other external IPs assigned to computers on my local network

    Basic host multiple servers for web, on different IP addresses, using port 80...

    for example, 202.x.x.1 port 80 using port before going to 192.168.168.1

    202.x.x.2 port 80 using the firewall rule to access 192.168.168.2

    202.x.x.3 port 80 using the firewall rule to access 192.168.168.3

    all other ports should show stealth

    (192.168.168.2 should show the external of the 202.x.x.2 address when you go to whatismyip.com)

    From what I read, it seems that the RV042 can do this, but I'm not real clear on what my rules should look like.

    I think my rule of priority for each external IP address would deny all traffic first for each machine on the local network.

    Then create a new entry with source of 202.x.x.2 80-> 192.168.168.2 port?

    How do you I put my rules to do so, and what settings should I on the network card of the second machine?

    very happy, thank you!

    The order of these two rules should be reversed.

  • How can I create a multi page PDF from a multi .tif file?  On the creation of a file .pdf from a file multiple .tif, the .tif file is converted to a single page (always the first page of the .tif file) .pdf.  The rest of the document is cut off. The .tif

    How can I create a multi page PDF from a multi .tif file?  On the creation of a file .pdf from a file multiple .tif, the .tif file is converted to a single page (always the first page of the .tif file) .pdf.  The rest of the document is cut off. The .tif file comes from a document by using the fax & Scan app scanner in Windows 10.  I am running Adobe Acrobat Reader DC, which I run with my subscription 'Adobe PDF package, monthly'.  It worked fine until about a month.  I've since upgraded to Windows 10 and Acrobat Reader DC.   I would be very grateful for any help. Eoghainn

    Hello

    This problem has been reported as a bug. Our team of engineers working on this priority issue.

    Kind regards
    Nicos

  • How to configure firefox to run as a single instance, so that all external links open within my existing window rather than opening another window?

    How to configure firefox to run as a single instance, so that all external links open within my existing window rather than opening another window?

    Sorry, there is no setting for what is built into Firefox.

    https://addons.Mozilla.org/en-us/Firefox/addon/tab-utilities/

    In the utilities tab > Options > links there is a preference to enable single window mode.

  • Help his Mac Mini? Connected to monitor w / sound coming from monitor. I tried speaker external buffering in the back of the unit and still get only his monitor speakers.

    Help his Mac Mini? Connected to monitor w / sound coming from monitor. I tried speaker external buffering in the back of the unit and still get only his monitor speakers.

    How is the monitor connected?

    Are to connect the speakers to the headphone 3.5 mm? And not the line-in jack 3.5?

    If you go to System Preferences > sound > you can select the speakers/headphones output?

  • Can I transfer pictures from a SD card to an external HD using iPad Air?

    Is there anyway to transfer pictures from a SD card to an external HD using just my iPad? I don't want to take my MacBook on a coming holidpay, would be nice rather just take my iPad but I could not find a way to do it without jailbreak iPad. I want to save my photos every day, so I do not lose their.

    Someone at - it managed?

    Cheears,

    Evan.

    As a general rule, no.

    If you have the SD card reader and a player like the Kingston WiDrive wireless, you may be able to transfer the pictures to the iPad then the iPad on this disc.

    If you have wifi, you could look for something like Flickr. You can download high or full resolution photos and store them here, then download them when you get home

  • How to send UDP packets to multiple IP addresses

    I can see the full dissemination of forwarding UDP (IP value FFFFFFFF) but I do not see how to send the UDP packet even two or three specified multiple IP addresses.

    Is it still possible?

    Thank you

    Pawel says:

    The multicast would work with other receivers of udp (no-LabVIEW) operating in a mode normal unitcast? Or all networking needs receivers operate in multicast mode?

    Clients must join a multicast group in order for the multicast work. This essentially means that you tell the OS you want traffic received on a specific IP address (multicast groups are the IP addresses within a specific range) and on a specific network interface.

  • copy files from my C drive to my external drive error E 0x800718ac3: the volume is dirty?

    Original title: can anyone help with this problem error 0x800718ac3: the volume is dirty?

    I am trying to copy files from my C drive to my external drive E using the operation drag and drop method. That's what happens "error 0x800718ac3: the volume is dirty" can you help me?

    Hello

    1. What is the full error message?

    2. what operating system is installed on the computer?

    3 did you changes to the computer before the show?

    4. What are the names of files and the exact location of the files you are trying to copy?

    Method 1:   Format the external drive of E and see if that helps.

    Reference:

    Formatting disks and drives: frequently asked questions:

    http://Windows.Microsoft.com/en-us/Windows7/formatting-disks-and-drives-frequently-asked-questions

    Note: Format deletes the data on the disk. Be sure to back up data before the format.

      

    Method 2: You can check the external E drive to find errors.

    Important: Running chkdsk on the drive if bad sectors are found on the disk hard when chkdsk attempts to repair this area if all available on which data may be lost

    Reference:

    Check a drive for errors:

     http://Windows.Microsoft.com/en-us/Windows7/check-a-drive-for-errors

  • The Vixia HF G30 allows a direct copy of video files from an SD card on an external USB hard disk

    I am considering buying a G30 and need to know if she will allow a direct copy of video files from an SD card on an external USB hard drive.  The manual is not clear on this point.

    Not to my knowledge (I own a G30 HF).  There is no present on-the-go USB functionality.

    Personally, I do not miss such a feature, because it causes all kinds of compatibility problems, especially with regard to the power of external USB hard drives. In addition, without any file manager, backup of your video files into a nightmare. I must admit that I am rather Cannon after not on an often incomplete function development budget and have it spent instead on the main features of the camera, such as optics. Of course, this is just my very subjective opinion, and other HF G30 clients may have different opinions on this.

    In order to back up my video files on the fly and without having to carry a laptop, I recently bought a made by Hanso Hyperdrive colorspace UDMA2 and installed a 1 TB in her drive. When on the ground and after having taken my shots I just pop in my inside SD cards and the device of copies on the video files to 17Mbyte per second. At home, I plug in the UDMA2 in my Linux video workstation using a regular USB cable and pull the video from the mobile disk. The UDMA2 also did incremental backups and comes with a basic file manager. While it has a color screen, it can't play back video. It is a video and photo backup dedicated device, nothing more. But it does a decent job on exactly that.

  • EA6500 multiple IP addresses on the Internet interface

    I have verizon fios business with 5 static IP addresses and am set up for ethernet wan. I can use EA6500 as the router instead of use the own router to Verizon, but I can't understand how to assign every 5 static IP on the internet interface addresses. I have already affected the first IP address in the Web interface, but don't see a way to add multiple IP addresses internet interface or NAT section where I can create static NAT.

    Is it still possible with EA6500? If so, how?

    I don't think it's possible, given that the router support 1 address static IP at a time.

  • Can I use private as Source IPs from a remote network IP addresses while building the IPSec tunnel?

    Can I use private as Source IPs from a remote network IP addresses while building the IPSec tunnel? If not why? If so, how?

    Your explanation is much appreciated.

    Hi Deepak,

    In such a situation, you usually NAT traffic that goes to the internet, but exempt traffic that goes through the VPN, because it will be wrapped in packages with public IP (tunnel) addresses. You can use the same IP address on your interface in the face of internet for the NAT/PAT and source of IPSEC Tunnel.

  • I need access to the address book and the internal files path

    I had to update windows, then Thunderbird. I'm trying to restore my address book and such internal records only sent and saved. I have backup, but I can't find the files into it.

    Tried several times but the data must be stored somewhere else.
    Thanks for the interest if. Looks like I have lost.

  • vSwitches and network traffic internal vs external

    In an effort to reduce copper that we adopt 10 GB NIC on our ESX 4.0 servers. This means that we will have many more VMs sharing a physical network card. Our network security architecture is such that servers are separated in different segments of network with access restricted by ACL in the physical network equipment, it is used to separate the databases of web servers, etc..  A question arose about the traffic that can pass between virtual machines but never cross the physical network.

    Linking rising 10 GB nic is connected to a port to shared resources, so we have two virtual machines that have different network segment addresses (different VLAN) will be communication between virtual machines only crosses the vSwitch or will be the release of traffic the ESX Server through the ACLed interface and return on the other virtual machine via the same uplink port?

    I thought that, given that each virtual machine has a gateway address specific, that traffic had to leave the ESX Server. But then again they will be on the same vSwitch if...?

    Kind regards

    Garrett

    If they are running on the same host, the vSwitch works as a physical switch, so, ideally, you can move the data of Vlan. . but in order to browse the segments, you need to hit the gateways defauilt for each segment.

    If your DG isn't on the ESX host. . Unfortunately, you're going to the physical network.

    How to keep the traffic on the Local host is to use Private Vllans to segment the traffic, or you can also install a VM device that can manage your default gateway (router on a stick) of routing

    If you have the device to your traffic. everything is local. otherwise. . Physical switch will not only take the traffic, but distribution to the next layer so that it can be done correctly.

  • A single contact - multiple addresses

    Hi Topliners.

    I have a perspective where the contact has more than one e-mail. How CFDS ensure me that my historic with the client is not lost, when you add a second emial.

    for example

    Departure: the customer has a @gmail.com and we've traced it to ½ year.

    Wish: The customer even would add its company email.

    What happens to the Eloquas of follow-up of the @gmail.com if I replace it with mail society in SFDC and Eloqua?

    Hi André,.

    We are on the right track with several beta customers and get closer to iron it on pending product and capacity issues as a result of the beta testing so far.  These are intended for our fall 14 release and we will probably promote this beta to availability, controlled at that time here.

    That said, I wanted to clarify the scope of the beta features.  What we worked on looks at the scenario where the customers want to have multiple contacts for the same individual, which translates addresses duplicate intentional.  The case of the main use here is one person to become a leader for more than a product of activity such as printers and laptops as a simple example.  The way in which the contact is fed, rated a lead, sent to the turnover, etc., can be very different for each product, so we would manage records in multiple contacts for the same person (with the same e-mail address).  We had to take a step-by-step approach to move away from e-mail as a unique ID.  The first phase of this project added support for contacts without email at all.  It will be generally available with our version of the coming summer.

    As we continue to move forward, we will turn our focus to support several e-mail addresses (personal view, work, different names, etc.) for the same person and to tackle the problem of identity resolution.  It is still a little further, but is the last step to finish the job that we have already begun.

    Hope this helps - happy to communicate with you if you have specific questions.

    Thank you

    Taha

Maybe you are looking for