NAT Port Forwarding is useful when you have a single public
IP address and multiple devices behind it that you want to reach from the
outside world. Take a look at the example below:
In the topology above we have an ASA firewall with a DMZ and
two servers…a HTTP server and a SSH server. Let’s imagine that the IP address
on the ASA’s E0/1 interface (192.168.2.254) is a public IP address. Our goal is
to make sure that we can reach these servers from the outside world. R2 is only
there so we have a device in the “outside” so we can try if NAT is working.
HTTP uses TCP port 80 and SSH uses TCP port 22 so what we’ll
do is forward these ports. Whenever someone connects on IP address 192.168.2.254
TCP port 80 we will forward them to 192.168.1.1 TCP port 80.
We can use different port numbers if we want and to
demonstrate this, we will configure the ASA so that whenever someone connects
on 192.168.2.254 TCP port 10022, we will forward it to 192.168.1.3 TCP port 22.
Let me show you how to configure this. We start with the
HTTP server:
ASA1(config)# object network WEB_SERVER
ASA1(config-network-object)# host 192.168.1.1
ASA1(config-network-object)# nat (DMZ,OUTSIDE) static
interface service tcp 80 80
We create a network object that specifies the real IP
address of the web server and then we create our NAT rule. By using the keyword
interface we tell the ASA to use the IP address on the (outside) interface. The
first port number is the port that the server is listening on, the second port
number is the outside port number. Let’s
configure another PAT entry for the SSH server:
ASA1(config)# object network SSH_SERVER
ASA1(config-network-object)# host 192.168.1.3
ASA1(config-network-object)# nat (DMZ,OUTSIDE) static
interface service tcp 22 10022
This network object is similar to the first one but you can
see I used a different port number for the outside. Whenever someone connects
on TCP port 10022, it will be forwarded to TCP port 22. This takes care of the
NAT rules but don’t forget to create an access-list or our traffic will be
dropped:
ASA1(config)# access-list DMZ_SERVERS extended permit tcp
any host 192.168.1.1 eq 80
ASA1(config)# access-list DMZ_SERVERS extended permit tcp
any host 192.168.1.3 eq 22
ASA1(config)# access-group DMZ_SERVERS in interface OUTSIDE
This access-list will allow traffic from the outside to our
servers. Let’s verify our work…
Verification
First we’ll take a look at the ASA NAT table:
ASA1# show xlate
2 in use, 3 most used
Flags: D - DNS, e - extended, I - identity, i - dynamic, r -
portmap,
s - static, T -
twice, N - net-to-net
TCP PAT from DMZ:192.168.1.1 80-80 to OUTSIDE:192.168.2.254
80-80
flags sr idle
0:02:20 timeout 0:00:00
TCP PAT from DMZ:192.168.1.3 22-22 to OUTSIDE:192.168.2.254
10022-10022
flags sr idle
0:00:29 timeout 0:00:00
This gives a nice overview of all the forwarded ports that
we configured. Now let’s see if we can connect to our HTTP and SSH server from
R2:
R2#telnet 192.168.2.254 80
Trying 192.168.2.254, 80 ... Open
Great, this is working. R2 is able to reach the HTTP server.
Let’s also try SSH:
R2#ssh -l cisco -p 10022 192.168.2.254
Password:
SSH_SERVER>
Excellent, SSH is also working! This is all you have to do
to make NAT port forwarding work on your Cisco ASA Firewall. If you have any
questions, feel free to leave a comment.
