Configuring NAT for a Public Server Using Same Outside Interface

The requirements:

• Allow inside users to access the Internet.

• Allow inside  web server to serve HTTP services to the Internet.

• Allow outside users to visit your web server.

Open command line of the ASA and create objects for your Inside network and your Web server: 

ASA# conf t

ASA(config)# object network INSIDE-SUBNET

ASA(config-network-object)# subnet 192.168.1.0 255.255.255.0

ASA(config-network-object)# exit

ASA(config)# object network WWW-SERVER

ASA(config-network-object)# host 192.168.1.200

ASA(config-network-object)# exit

Then you configure NAT so your Inside users can browse the web:

ASA(config)# object network INSIDE-SUBNET

ASA(config-network-object)# nat (inside,outside) dynamic interface

ASA(config-network-object)# exit

Configure static NAT with port forwarding: 

ASA(config)# object network WWW-SERVER

ASA(config-network-object)# nat (inside,outside) static interface service tcp 80 80

ASA(config-network-object)# exit

Configure an access list to allow Outside traffic to visit port 80 (http) to your Outside interface: 

ASA(config)# access-list Outside_access_in extended permit tcp any object WWW-SERVER eq 80

ASA(config)# access-group Outside_access_in in interface Outside

Verify your NAT configuration and test: 

ASA# show nat

Auto NAT Policies (Section 2)

1 (Inside) to (Outside) source static WWW-SERVER interface service tcp www www

 translate_hits = 0, untranslate_hits = 2

2 (Inside) to (Outside) source dynamic INSIDE-SUBNET interface

 translate_hits = 6, untranslate_hits = 0