> I have defined dynamic source nat rule: > > Here is the relevant config: > > object network obj-10.201.0.0 > subnet 10.201.0.0 255.255.0.0 > > object network obj-2.2.2.102 > host 2.2.2.102 > > nat (inside,outside) source dynamic obj-10.201.0.0 obj-2.2.2.102
Food for thought (not sure if this is worse/better/same). Say the outside interface, 2.2.2.102, is part of network 2.2.2.96/28 ! object network Obj-Everything subnet 0.0.0.0 0.0.0.0 ! ! Subnet that non-employees end up on; they go out via a different ! public IP object network Obj-Guest-Net subnet 172.20.0.0 255.255.0.0 ! object network Obj-Everything nat (inside,outside) dynamic interface object network Obj-Guest-Net nat (inside,outside) dynamic 2.2.2.103 > What i am looking to do, if possible (i believe it should be) is do a > static mapping from the outside of 2.2.2.102:80 to a single ip address in > the > 10.201.0.0/16 net, for ex 10.201.10.10:80 > > [...] > > Is that correct? Also, what is the syntax for mapping only port 80 of > obj-2.2.2.102 to obj-10.201.10.10? > so, obj-2.2.2.102 port 80 to obj-10.201.10.10 port 80 "Map all ports on public IP x to private IP y" should be similar but we have only implemented the latter, more specific case: object network HostName1_TCP7979 host 10.201.1.10 object network HostName1_TCP8888 host 10.201.1.10 ! object-group service HostName-Ports tcp description GPIM active tcp ports port-object eq 7979 port-object eq 8888 ! access-list Inbound extended permit tcp any host 10.201.1.10 object-group HostName-Ports log ! object network HostName1_TCP7979 nat (inside,outside) static interface service tcp 7979 7979 object network HostName1_TCP8888 nat (inside,outside) static interface service tcp 8888 8888 ! I do remember the sh run output for the object related commands in 8.3 seemed a little wacky, but looking at this I'm not sure if we tried something like this or not: Object network HostName1_PortMap host 10.201.1.10 nat (inside,outside) static interface service object HostName-Ports ~JasonG _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
