# Cisco ASA NAT Port Forwarding
**URL:** https://forum.networklessons.com/t/cisco-asa-nat-port-forwarding/818
**Category:** Lessons Discussion
**Created:** [December 19, 2016, 4:09pm UTC](https://forum.networklessons.com/t/cisco-asa-nat-port-forwarding/818 "2016-12-19T16:09:36Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [December 19, 2016, 4:09pm UTC](https://forum.networklessons.com/t/cisco-asa-nat-port-forwarding/818/1 "2016-12-19T16:09:36Z")
This topic is to discuss the following lesson:
> **[Cisco ASA NAT Port Forwarding](https://networklessons.com/cisco/asa-firewall/cisco-asa-nat-port-forwarding)**
>
> This lesson explains how to configure NAT (Network Address Translation) port forwarding on your Cisco ASA Firewall.
---
### Author:  [@rspela830](https://forum.networklessons.com/u/rspela830)
#### Post date: [May 31, 2015, 9:21pm UTC](https://forum.networklessons.com/t/cisco-asa-nat-port-forwarding/818/2 "2015-05-31T21:21:22Z")
Rene,
Your scenario explains forwarding traffic to port 22 for SSH, but further down in your configuration example you are using port 25 for SMTP. Any reason for the change between the scenario and the example configuration??
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [June 1, 2015, 10:03am UTC](https://forum.networklessons.com/t/cisco-asa-nat-port-forwarding/818/3 "2015-06-01T10:03:15Z")
Hi Ralph,
That was a typo, I just changed port 25 to 22. Thanks for letting me know!
Rene
---
### Author:  [@taslimmajid](https://forum.networklessons.com/u/taslimmajid)
#### Post date: [October 15, 2015, 11:58am UTC](https://forum.networklessons.com/t/cisco-asa-nat-port-forwarding/818/4 "2015-10-15T11:58:34Z")
Hi Rene,
Thank you for the explanation.
I have a question.
In this tutorial, you are using PAT for sending traffic from Outside to DMZ. However, if I want to use PAT for sending traffic from DMZ to Outside, how should I do the configurations ?
Thank you
Taslim
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [October 16, 2015, 4:10pm UTC](https://forum.networklessons.com/t/cisco-asa-nat-port-forwarding/818/5 "2015-10-16T16:10:44Z")
Hi Taslim,
Hmm why would you want to do this? 🙂 We use PAT in this example so that someone on the Internet is able to connect to a public IP address on the outside so that we can reach our DMZ servers with private IP addresses.
Our DMZ servers can reach the Internet by using “regular” NAT.
Rene
---
### Author:  [@hvasudeva](https://forum.networklessons.com/u/hvasudeva)
#### Post date: [November 19, 2015, 4:49am UTC](https://forum.networklessons.com/t/cisco-asa-nat-port-forwarding/818/6 "2015-11-19T04:49:13Z")
Hi Rene,
Diagram needs to be updated to 192.16.1.0/24 for lan subnet.
---
### Author:  [@hvasudeva](https://forum.networklessons.com/u/hvasudeva)
#### Post date: [November 19, 2015, 4:49am UTC](https://forum.networklessons.com/t/cisco-asa-nat-port-forwarding/818/7 "2015-11-19T04:49:44Z")
I mean 192.168.1.0/24
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [November 19, 2015, 10:57am UTC](https://forum.networklessons.com/t/cisco-asa-nat-port-forwarding/818/8 "2015-11-19T10:57:17Z")
Hi Harmit,
Thanks, I just fixed the text so it matches the diagram.
Rene
---
### Author:  [@ratha.chum9](https://forum.networklessons.com/u/ratha.chum9)
#### Post date: [December 3, 2015, 4:28am UTC](https://forum.networklessons.com/t/cisco-asa-nat-port-forwarding/818/9 "2015-12-03T04:28:33Z")
Base on this configuration, it working with ASA 8.4 or later.
Can you show me if ASA 8.2 or older, how to configure ASA 8.2 or older?
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [December 3, 2015, 11:13am UTC](https://forum.networklessons.com/t/cisco-asa-nat-port-forwarding/818/10 "2015-12-03T11:13:09Z")
It should be something like this:
`static (DMZ,OUTSIDE) tcp netmask 255.255.255.255`
---
### Author:  [@pbyrne](https://forum.networklessons.com/u/pbyrne)
#### Post date: [December 21, 2015, 9:38pm UTC](https://forum.networklessons.com/t/cisco-asa-nat-port-forwarding/818/11 "2015-12-21T21:38:56Z")
Hi Rene,
Is there any reason given by Cisco as to why the order of operations was changed on the Asa 8.3 code?
The real ip’s in the acls and the post natt’d port numbers etc
Thanks
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [December 22, 2015, 9:41am UTC](https://forum.networklessons.com/t/cisco-asa-nat-port-forwarding/818/12 "2015-12-22T09:41:20Z")
Hi Paul,
Not that I know of, I tried looking it up but couldn’t find anything.
Rene
---
### Author:  [@iniguezjuan](https://forum.networklessons.com/u/iniguezjuan)
#### Post date: [January 18, 2016, 5:23am UTC](https://forum.networklessons.com/t/cisco-asa-nat-port-forwarding/818/13 "2016-01-18T05:23:12Z")
Rene,
Hi Rene… For some reason when trying to telnet from my outside router to my http server I keep getting error message “Connection refused by remote host” I was able to successfully ssh into my ssh server. Also I am able to telnet from ssh server to http server so I know the configuration is correct any idea ?
Thanks in advance.
```auto
interface GigabitEthernet0
nameif DMZ
security-level 50
ip address 10.1.1.254 255.255.255.0
!
interface GigabitEthernet1
nameif OUTSIDE
security-level 0
ip address 12.1.1.254 255.255.255.0
!
object network WEB_SERVER
host 10.1.1.1
object network SSH_SERVER
host 10.1.1.2
access-list DMZ_SERVERS extended permit tcp any host 10.1.1.1 eq www
access-list DMZ_SERVERS extended permit tcp any host 10.1.1.2 eq ssh
!
object network WEB_SERVER
nat (DMZ,OUTSIDE) static interface service tcp www www
object network SSH_SERVER
nat (DMZ,OUTSIDE) static interface service tcp ssh ssh
access-group DMZ_SERVERS in interface OUTSIDE
!
class-map icmp
match default-inspection-traffic
!
!
policy-map icmp_policy
class icmp
inspect icmp
inspect http
!
service-policy icmp_policy global
```
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [January 19, 2016, 11:38am UTC](https://forum.networklessons.com/t/cisco-asa-nat-port-forwarding/818/14 "2016-01-19T11:38:30Z")
Hi Juan,
Your configuration is looking good to me. SSH from OUTSIDE to DMZ is no problem?
Is it possible it’s something else? perhaps no route or default gateway on the HTTP server pointing to your ASA?
Rene
---
### Author:  [@iniguezjuan](https://forum.networklessons.com/u/iniguezjuan)
#### Post date: [January 19, 2016, 7:46pm UTC](https://forum.networklessons.com/t/cisco-asa-nat-port-forwarding/818/15 "2016-01-19T19:46:18Z")
Rene,
Correct SSH from OUTSIDE TO DMZ is working fine… I configured my hhtp server (Router 2) to allow ssh with the following command
`access-list DMZ_SERVERS extended permit tcp any host 10.1.1.1 eq ssh`
Now I can remote in but by using the routers IP ex:(ssh -l Cisco 10.1.1.1) for some reason my ASA is no nating/port forwarding to my http server
```auto
ciscoasa# show xlate
2 in use, 2 most used
Flags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twice
TCP PAT from DMZ:10.1.1.1 80-80 to OUTSIDE:12.1.1.254 80-80
flags sr idle 0:05:12 timeout 0:00:00
TCP PAT from DMZ:10.1.1.2 22-22 to OUTSIDE:12.1.1.254 22-22
flags sr idle 0:09:33 timeout 0:00:00
```
```auto
ciscoasa# show nat
Auto NAT Policies (Section 2)
1 (DMZ) to (OUTSIDE) source static WEB_SERVER interface service tcp www www
translate_hits = 0, untranslate_hits = 23
2 (DMZ) to (OUTSIDE) source static SSH_SERVER interface service tcp ssh ssh
translate_hits = 14, untranslate_hits = 6
```
not sure why!!!
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [January 19, 2016, 9:38pm UTC](https://forum.networklessons.com/t/cisco-asa-nat-port-forwarding/818/16 "2016-01-19T21:38:40Z")
Hi Juan,
Your ASA configuration does look ok and seems to translate HTTP traffic. If you enable a debug IP packet (with an access-list) or debug ip http can you see anything?
Using packet tracer on the ASA also helps to check if you have any errors.
Rene
---
### Author:  [@net2](https://forum.networklessons.com/u/net2)
#### Post date: [March 9, 2016, 12:09pm UTC](https://forum.networklessons.com/t/cisco-asa-nat-port-forwarding/818/17 "2016-03-09T12:09:02Z")
Hi Rene
I do the lab again and set the default route to the firewall.
I can check port 80 on the Web Server by you command in this example “telnet 192.168.2.254 80” but I can’t use “ssh -l cisco -p 10022 192.168.2.254” from R2 to outside ip of firewall.
I dont know why is it?
I think it should be nat static to SSH server 192.168.3.3
Please help me resolve this!
Thank you!
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [March 10, 2016, 10:02pm UTC](https://forum.networklessons.com/t/cisco-asa-nat-port-forwarding/818/18 "2016-03-10T22:02:39Z")
Just a couple of things to check…
- Can you SSH from the webserver into the SSH server? that proves SSH is working.
- Do you have a default route on the SSH server towards the ASA?
- Do you see a matching entry in show xlate?
---
### Author:  [@abdullimran](https://forum.networklessons.com/u/abdullimran)
#### Post date: [May 12, 2016, 7:33pm UTC](https://forum.networklessons.com/t/cisco-asa-nat-port-forwarding/818/19 "2016-05-12T19:33:56Z")
Not sure I am correct,but this should allow telnet from outside
en
config t
telnet 0.0.0.0 0.0.0.0 outside
---
### Author:  [@abdullimran](https://forum.networklessons.com/u/abdullimran)
#### Post date: [May 13, 2016, 1:17pm UTC](https://forum.networklessons.com/t/cisco-asa-nat-port-forwarding/818/20 "2016-05-13T13:17:13Z")
This might be correct
config t
telnet 0.0.0.0 0.0.0.0 outside
[Next page](https://forum.networklessons.com/t/cisco-asa-nat-port-forwarding/818.md?page=2)