Cisco ASA Static NAT Configuration

Hello Azm

In the given configuration, the NAT setup on an ASA is such that the entire DMZ subnet (192.168.1.0/24) is statically NATed to a single public IP address (100.100.100.100). This means that any host in the DMZ subnet appearing on the outside network will have its source IP translated to 100.100.100.100. However, the ASA will use different source ports to distinguish between the different connections. Even if the destination on the Internet is the same IP address (say the same web server) they will be distinct communications because the source port is different.

Static NAT is bidirectional, but only under certain circumstances.

There are two types of inbound communications. The first is a response to a previous outbound communication, i.e., a response from a web browser to a request for data. Such traffic is allowed and is directed to the host that originated the request based on the destination TCP port used.

The second type is a communication that was originated on the outside. Such a communication will not be successful unless you have certain other conditions met. For example, by default an ASA will not allow traffic to go from the outside interface to the DMZ interface unless you have set up an access list that permits it. Secondly, because you are configuring a “one to many” translation (i.e. from one outside IP to a whole subnet on the inside) you must also set up port forwarding so that the appropriate destination TCP port is translated and forwarded to the correct inside host. As your setup stands now, any communication initiated on the outside will be dropped.

I hope this has been helpful!

Laz