Cisco 7609-S Configuration Guide - Page 337

Chapter 16 Configuring NAT Bypassing NAT hostname(config)# static (inside,outside) tcp 10.1.2.14 telnet access-list TELNET For HTTP traffic initiated from hosts on the 10.1.3.0 network to the FWSM outside interface (10.1.2.14), you can redirect the traffic to the inside host at 10.1.1.15 by entering: hostname(config)# access-list HTTP permit tcp host 10.1.1.15 10.1.3.0 255.255.255.0 eq http hostname(config)# static (inside,outside) tcp 10.1.2.14 http access-list HTTP To redirect Telnet traffic from the FWSM outside interface (10.1.2.14) to the inside host at 10.1.1.15, enter the following command: hostname(config)# static (inside,outside) tcp 10.1.2.14 telnet 10.1.1.15 telnet netmask 255.255.255.255 If you want to allow the preceding real Telnet server to initiate connections, though, then you need to provide additional translation. For example, to translate all other types of traffic, enter the following commands. The original static command provides translation for Telnet to the server, while the nat and global commands provide PAT for outbound connections from the server. hostname(config)# static (inside,outside) tcp 10.1.2.14 telnet 10.1.1.15 telnet netmask 255.255.255.255 hostname(config)# nat (inside) 1 10.1.1.15 255.255.255.255 hostname(config)# global (outside) 1 10.1.2.14 If you also have a separate translation for all inside traffic, and the inside hosts use a different mapped address from the Telnet server, you can still configure traffic initiated from the Telnet server to use the same mapped address as the static statement that allows Telnet traffic to the server. You need to create a more exclusive nat statement just for the Telnet server. Because nat statements are read for the best match, more exclusive nat statements are matched before general statements. The following example shows the Telnet static statement, the more exclusive nat statement for initiated traffic from the Telnet server, and the statement for other inside hosts, which uses a different mapped address. hostname(config)# static (inside,outside) tcp 10.1.2.14 telnet 10.1.1.15 telnet netmask 255.255.255.255 hostname(config)# nat (inside) 1 10.1.1.15 255.255.255.255 hostname(config)# global (outside) 1 10.1.2.14 hostname(config)# nat (inside) 2 10.1.1.0 255.255.255.0 hostname(config)# global (outside) 2 10.1.2.78 To translate a well-known port (80) to another port (8080), enter the following command: hostname(config)# static (inside,outside) tcp 10.1.2.45 80 10.1.1.16 8080 netmask 255.255.255.255 Bypassing NAT This section describes how to bypass NAT. You might want to bypass NAT when you enable NAT control. You can bypass NAT using identity NAT, static identity NAT, or NAT exemption. See the "Bypassing NAT when NAT Control is Enabled" section on page 16-10 for more information about these methods. This section includes the following topics: • Configuring Identity NAT, page 16-34 • Configuring Static Identity NAT, page 16-34 • Configuring NAT Exemption, page 16-36 OL-20748-01 Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM 16-33