新聞財經娛樂♬資訊 News Economy

my need is that this server is reachable from the outside again through the public IP on which there is already a NAT server, but this should appear on Internet with a different public IP.
Thanks.

I can be done via static PAT, just not static NAT.

I am very surprised that this rule can not be done with a Cisco device, I do it with other Linux based firewall with fwbuilder and this is a simple thing, in attached file this rule made ​​with fwbuilder.

Actually, doing some quick research, what you want to do is not possible. The only way to have two static statements for the same real IP address (192.168.1.246) with the same interface mapping (inside,outside) is to do static PAT. This does make sense.

http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/nat_staticpat.html#wpxref54039

Looks like everything you are currently doing is based on a TPC or UDP port for inbound traffic. You could try adding the general NAT in to make the traffic from this server going outbound appear on the different IP address. I have never done this, so I am unsure if it will really work, however it would seem to me that it might. You can try using the statement I provided above to accomplish this, however as not knowing what affect it might have on the current NAT, you may want to do this inside of a maintenance window, or a time when users are least likely to hit this service from the outside.

in attach configuration file.
I wish the machine with IP 192.168.1.246 go on the Internet with a public IP address different from the one with which you currently presents on the internet.
My public IP I replaced them with 2.2.2.
Thanks.

Can you post your configuration here? You can change IP addresses so that your information isn't public, however it may help in assisting you better.

the rule that you have shown me that is just coming out ?
I ask this because I need only output and not input because this is already nat rule private ip --> public IP on a different public IP and this rule should remain.
Thanks.

Did you read this article for configure NAT  from CISCO ?
http://www.cisco.com/c/en/us/td/docs/security/asa/asa80/configuration/guide/conf_gd/cfgnat.html#wp1043599

Duncan

You would configure a rule as follows...

static (inside,outside) 4.2.2.2 192.168.1.200 netmask 255.255.255.255

To break down this statement, you're creating a static mapping from real interface to the mapped interface. Next you are specifying the external IP address, the one you want this traffic to be seen as to the rest of the world. Then, mapping that to the internal host IP address. Finally, just a netmask of 255.255.255.255 as it's a host.

Don't forget, in case you haven't already done so, configure NAT for all other addresses on the inside of the ASA...

nat (inside) 1 0.0.0.0 0.0.0.0

If you were to update the OS on your ASA to something 8.4 or later, the NAT configuration changes to the following...

object network obj-192.168.1.200
 host 192.168.1.200
 nat (inside,outside) static 4.2.2.2

Hope this makes sense to you.