0

I was wondering whether anyone could advice on best practices as to the best way to redirect multiple ports for single host in the internal network.

As I understand this you can only nat a single port per object. This caused a bit of a litter around in a config as I have to specify individual objects for the same host (IP) to redirect individual ports.

It looks as follows:

object network ratatouille-4569
 nat (inside,outside) static interface service udp 4569 4569 
object network ratatouille-ssh
 nat (inside,outside) static interface service tcp ssh ssh

Now this approach have few obvious problems (especially if you've more complex/more rules) eg. if you need to change that internal host's IP address, you've to do this for each object individually.

In this specific case, I have 7 ports to redirect to this specific host.

I'd appreciate any advice about best-practice as how to do this.

bart613
  • 548
  • 1
  • 6
  • 15

2 Answers2

0

It's imposible. You need to either specify each of the mapped ports manually or just set up a regular static NAT for all the TCP / UDP ports:

object network ratatouille
 nat (inside,outside) static interface
Guardian
  • 199
  • 4
  • Yeah but in this case you're using the whole IP for just one internal host. In my case, I've a single IP but multiple internal host which I want to redirect ports to. I was more hoping for some advice what's the best way to maintain that. Any specific naming conventions you guys use or some other tricks? Or just do as I did above and keep it going like this? – bart613 Feb 28 '13 at 15:24
0

... and control desired ports with ACL assigned to outside interface

access-list ratatouille-port-control permit tcp any host ratatouille.inside.IP eq 22 access-list ratatouille-port-control permit tcp any host ratatouille.inside.IP eq 4569 access-list ratatouille-port-control permit tcp any host ratatouille.inside.IP eq 8080 access-group ratatouille-port-control outside in

Eol
  • 1
  • 1
    Please give a complete answer. This appears to be a comment or follow-on to another question, but your answer can appear on its own so the meaning is unclear. – Andrew Schulman Jun 28 '15 at 10:35