Install Java in Ubuntu

https://www.digitalocean.com/community/tutorials/how-to-install-java-on-ubuntu-with-apt-get

Cisco ASA Static NAT Configuration




Static NAT defines a one-to-one mapping from one IP subnet to another IP subnet. The mapping includes destination IP address translation in one direction and source IP address translation in the reverse direction. From the NAT device, the original destination address is the virtual host IP address while the mapped-to address is the real host IP address.

Static NAT allows connections to be originated from either side of the network, but translation is limited to one-to-one or between blocks of addresses of the same size. For each private address, a public address must be allocated. No address pools are necessary.


Lets look at this example, an outside host on the Internet wants to reach a server in DMZ. But we cant do this with dynamic NAT or PAT. To make a successful connection to the right server following need to be done:

  • Configure static NAT so that the internal server is reachable through an outside public IP address.
  • Configure an access-list so that the traffic is allowed.

To demonstrate static NAT I will use the following topology:





ASA firewall : two interfaces; 1) DMZ  2) outside world. 
R1 webserver on the DMZ 
R2 is some host on the Internet that wants to reach our webserver.


STATIC NAT CONFIGURATION
First we will create a network object that defines our “webserver” in the DMZ and also configure to what IP address it should be translated. This configuration is for ASA version 8.3 and later:




ASA1(config)# object network WEB_SERVER
ASA1(config-network-object)# host 192.168.1.1
ASA1(config-network-object)# nat (DMZ,OUTSIDE) static 192.168.2.200

The configuration above tells the ASA that whenever an outside device connects to IP address 192.168.2.200 that it should be translated to IP address 192.168.1.1. This takes care of NAT but we still have to create an access-list or traffic will be dropped:



ASA1(config)# access-list OUTSIDE_TO_DMZ extended permit tcp any host 192.168.1.1


The access-list above allows any source IP address to connect to IP address 192.168.1.1. When using ASA version 8.3 or later you need to specify the “real” IP address, not the “NAT translated” address. Let’s activate this access-list:


ASA1(config)# access-group OUTSIDE_TO_DMZ in interface OUTSIDE


This enables the access-list on the outside interface. Let’s telnet from R2 to R1 on TCP port 80 to see if it works:



R2#telnet 192.168.2.200
Trying 192.168.2.200 ... Open
Great, we are able to connect from R2 to R1, let’s take a look at the ASA to verify some things:
ASA1# show xlate
1 in use, 1 most used
Flags: D - DNS, e - extended, I - identity, i - dynamic, r - portmap,
       s - static, T - twice, N - net-to-net
NAT from DMZ:192.168.1.1 to OUTSIDE:192.168.2.200
    flags s idle 0:08:44 timeout 0:00:00
ASA1# show access-list
access-list cached ACL log flows: total 0, denied 0 (deny-flow-max 4096)
            alert-interval 300
access-list OUTSIDE_TO_DMZ; 1 elements; name hash: 0xe96c1ef3
access-list OUTSIDE_TO_DMZ line 1 extended permit tcp any host 192.168.1.1 eq www (hitcnt=6) 0x408b914e
Above you can see the static NAT entry and also the hit on the access-list. Everything is working as it is supposed to be.
Static NAT for entire subnet
The previous example was fine if you have only a few servers since you can create a couple of static NAT translations and be done with it. There is another option though, it’s also possible to translate an entire subnet to an entire pool of IP addresses. Let me give you an example of what I’m talking about:
ASA1-R1-R3-dmz-R2-outsideThe topology above is the exact same as the previous example but I have added R3 to the DMZ. Now imagine that our ISP gave us a pool of IP addresses, let’s say 10.10.10.0 /24. We can use this pool to translate all the servers in the DMZ, let me show you how:
ASA1(config)# object network PUBLIC_POOL
ASA1(config-network-object)# subnet 10.10.10.0 255.255.255.0
First we configure the pool with IP addresses. Our next step is to create a network object for the DMZ subnet and to enable NAT:
ASA1(config)# object network DMZ
ASA1(config-network-object)# subnet 192.168.1.0 255.255.255.0
ASA1(config-network-object)# nat (DMZ,OUTSIDE) static PUBLIC_POOL
The configuration above tells the ASA to translate any IP address from the subnet DMZ (192.168.1.0 /24) to an IP address in the PUBLIC_POOL (10.10.10.0 /24). Last but not least, let’s make the access-list:
ASA1(config)# access-list OUTSIDE_TO_DMZ permit tcp any 192.168.1.0 255.255.255.0
and activate it on the outside:
ASA1(config)# access-group OUTSIDE_TO_DMZ in interface OUTSIDE
That’s all we have to configure, let’s verify our work:
ASA1# show xlate
1 in use, 1 most used
Flags: D - DNS, e - extended, I - identity, i - dynamic, r - portmap,
       s - static, T - twice, N - net-to-net
NAT from DMZ:192.168.1.0/24 to OUTSIDE:10.10.10.0/24
    flags s idle 0:02:00 timeout 0:00:00
You can see that the entire DMZ subnet 192.168.1.0 /24 will be translated to our 10.10.10.0 /24 pool. Let’s enable a debug so we can see what addresses are used when we translate:
ASA1# debug nat 255
debug nat  enabled at level 255
Now I’ll connect from R2 to the first IP address in the pool:
R2#telnet 10.10.10.1
Trying 10.10.10.1 ... Open
You can see that it connects and the ASA will show the following output:
ASA1# nat: untranslation - OUTSIDE:10.10.10.1/23 to DMZ:192.168.1.1/23 (xp:0xab2b3980, policy:0xad2632a0)
Whenever we connect to 10.10.10.1 it corresponds with the first IP address of the DMZ so we are connected to R1. Let’s see how we can connect to R3:
R2#telnet 10.10.10.3
Trying 10.10.10.3 ... Open
It’s connected and this is what the ASA thinks of it:
ASA1# nat: untranslation - OUTSIDE:10.10.10.3/23 to DMZ:192.168.1.3/23 (xp:0xab2b3980, policy:0xad2632a0)
The third IP address in the pool is translated to the third IP address of the DMZ which is R3.
This demonstrates that each IP address in the pool is translated to the “same” IP address in the DMZ. For example:
·         10.10.10.1 > 192.168.1.1
·         10.10.10.3 > 192.168.1.3
·         10.10.10.200 > 192.168.1.200
·         etc.
That’s all I have about static NAT on the Cisco ASA firewall for now. Hopefully this lesson has been useful, if you have any questions feel free to leave a comment!