CloudLabBox
Try the free demo

Cisco ASA lab 4 of 15

Object NAT: dynamic PAT, static NAT and port forwarding

Give the office and the DMZ internet access with interface PAT, publish the web server with static NAT, then tighten it to port-specific static PAT, reading every translation with show nat, show xlate and packet-tracer.

Run this lab

It needs Lite: its 4 nodes are set to 4 vCPU and 3,584 MB in total. That fits the free demo too.

In your workspace: Shared, then Cisco ASA Firewall SCOR 350-701 guided labs, then 04 - Object NAT - dynamic PAT static NAT and port forwarding

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 60 minutes
Nodes need
4 vCPU, 3,584 MB
Smallest plan
Lite

The scenario

In labs 1 to 3 the ISP kindly routed Kestrel's private ranges back to the firewall. That is over: the ISP now only knows Kestrel's public block, 203.0.113.0/24, on the link to HQ-FW. Private addresses must never leave the building.

Requirements:

  1. Office PCs (10.10.10.0/24) reach the internet through the firewall's outside address.
  2. DMZ servers (172.16.10.0/24) reach the internet through the same address.
  3. The public web site is published at 203.0.113.10 on HTTP.
  4. The web team needs Telnet to WEB from the internet during a migration, on 203.0.113.10 port 2323, and nothing else may be exposed.

What you’ll practise

  • Configure object (auto) NAT: dynamic PAT to the interface, static NAT and static PAT
  • Explain why ACLs use real addresses after ASA 8.3
  • Explain object NAT ordering: static before dynamic, then longest prefix
  • Read show nat detail, show xlate and the NAT phases in packet-tracer
  • Explain proxy ARP for mapped addresses

The tasks

  1. See the problem
  2. PAT for the office and the DMZ
  3. Publish the web site
  4. Publish only what you need
  5. Read the translations

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Object NAT - dynamic PAT static NAT and port forwarding4 nodes, 3 links. Every link is listed as text below the diagram.HQ-FWPC1WEBISPGi0/1Gi0/0Gi0/0Gi0/0Gi0/2Gi0/0
4 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • HQ-FW Gi0/0 to PC1 Gi0/0
  • HQ-FW Gi0/1 to ISP Gi0/0
  • HQ-FW Gi0/2 to WEB Gi0/0
Nodes in Object NAT: dynamic PAT, static NAT and port forwarding, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
HQ-FWCisco ASAvasav-9.22.1.1-PLR-Licensed1 vCPU, 2,048 MB
PC1Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
WEBCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
ISPCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Cisco ASA Firewall SCOR 350-701 guided labs.

  3. Open 04 - Object NAT - dynamic PAT static NAT and port forwarding and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Cisco ASA labs

All Cisco ASA labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.