Note that in the above configurations the host statement identifies the internal server (192.168.102.5 is the Web server and 192.168.102.6 is the mail server). (The exclamation marks are for formatting to improve readability and are not required for the configuration.) These identify the internal hosts, the desired outside IP address, and the type of service to be forwarded. Configure a network object for each internal host with a static NAT static statement specifying the outside address to be used and the service types (port numbers) to be forwarded. The steps are similar for single-address static NAT configuration:ġ. You can configure static NAT to accomplish this, and again, in the real world the outside interface would probably be configured with registered, public addresses instead of the RFC 1918 addresses shown here.

You want each of the servers to be reachable via different outside addresses. Also, suppose you have a mail server using POP3 and SMTP and a Web server using HTTP and HTTPS on the inside network. It is possible, however, to configure the ASA to forward different outside addresses to different hosts on the inside network.įor example, you have a /29 block of addresses assigned by your ISP. It is not possible to assign multiple IP addresses to the outside interface on a ASA appliance. Configuring the ASA with multiple outside interface addresses When successfully implemented, this configuration will permit a host on the outside network, such as the public Internet, to connect to the internal Web server using the address on the ASA's outside interface. Build the Access-Control List to permit the traffic flow (this statement goes on a single line): access-list OutsideToWebServer permit tcp any host 192.168.102.5 eq Apply the ACL to the outside interface using the Access-Group command: access-group OutsideToWebServer in interface outside. The second use of 80 identifies the destination port number.ģ. The first use of 80 identifies the originating port number. Note that, in the static NAT statement above, the use of the term interface tells NAT to use whatever address is on the outside interface. Create a NAT statement identifying the outside interface. Within the network object, you must also create a static NAT statement to identify the outside interface, its IP address, and the type of traffic to be forwarded: object network InternalHost host 192.168.102.5 nat (inside,outside) static interface service tcp 80 80.Ģ. A network object must be created identifying the internal host.

Create the network object and static NAT statement. There are four steps involved in enabling static NAT:ġ.

Configure cisco 5505 asa for home use