Cisco ASA 5510 Natting 2 internal ip to 1 public ip

Question

Hi Guys,
I have a doubt on how do nat 2 internal ip addresses to 1 public ip for FTP uses.
As I know Cisco ASA cannot use to nat 2 internal ips to 1 public ip as the ASA cannot read the host header. It there anyway to control it by using acl or network object group?
My current configuration for nat 1 internal ip to 1 public ip:
static (firewall-dmz,firewall-outside) tcp 210.19.xx.xx 21 172.16.101.11 21 netmask 255.255.255.255  dns
Thank you for your help.
Cheers
Tommy

Answer 1

Yes it is possible . See if this helps.  I'm not in front of my ASA right now, but I think this is the old and new way.  If you are actually using the interface address, you might need to use the "interface" keyword
Pre 8.3
static (inside,outside) tcp 1.1.1.1 80 192.168.1.100 8080 netmask  255.255.255.255
static (inside,outside) tcp 1.1.1.1 8080 192.168.1.101 8080 netmask  255.255.255.255
static (inside,outside) tcp 1.1.1.1 25 192.168.1.102 25 netmask  255.255.255.255
8.3 and Later
object network obj-192.168.1.100
  host 192.168.1.100
  nat (inside,outside) static 1.1.1.1 service tcp 8080 80
object network obj-192.168.1.101
  host 192.168.1.101
  nat (inside,outside) static 1.1.1.1 service tcp 8080 8080
object network obj-192.168.1.102
  host 192.168.1.102
  nat (inside,outside) static 1.1.1.1 service tcp 25 25
If you are using the interface address--
static (inside,outside) tcp interface 80 192.168.1.100 8080 netmask  255.255.255.255
static (inside,outside) tcp interface 8080 192.168.1.101 8080 netmask  255.255.255.255
static (inside,outside) tcp interface 25 192.168.1.102 25 netmask  255.255.255.255
8.3 and Later
object network obj-192.168.1.100
  host 192.168.1.100
  nat (inside,outside) static interface service tcp 8080 80
object network obj-192.168.1.101
  host 192.168.1.101
  nat (inside,outside) static interface service tcp 8080 8080
object network obj-192.168.1.102
  host 192.168.1.102
  nat (inside,outside) static interface service tcp 25 25