Static Port Address Translation 8.4

Question

Hello Experts,
Is the static Port Address Translation is bidirectional in 8.4 ???
I have configured static port address translation for the 2 server with same Public IP for the port 80 and 23. The strange thing is when they initiate a connection to the outside world they are allowed access to the internet as they are not included in the Dynamic Port address translation pool.
object network inside network.
subnet 192.168.10.0 255.255.255.0
Can anybody help me.
Thanks

Answer 1

Hello Dears
Packet tracer for the Static port redirection server IP's.
ciscoasa(config)# sh conn
1 in use, 1 most used
TCP outside 1.1.1.1:23 inside 2.2.2.2:28826, idle 0:00:09, bytes 149, flags UIO
ciscoasa(config)# sh xlate
2 in use, 3 most used
Flags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twice
TCP PAT from inside:2.2.2.2 23-23 to outside:3.3.3.3 23-23
    flags sr idle 2:11:34 timeout 0:00:00
TCP PAT from inside:10.10.10.1 8080-8080 to outside:3.3.3.3 80-80
    flags sr idle 2:11:34 timeout 0:00:00
ciscoasa(config)# sh local-host
Interface management: 0 active, 0 maximum active, 0 denied
Interface inside: 1 active, 2 maximum active, 0 denied
local host: <2.2.2.2>,
    TCP flow count/limit = 1/unlimited
    TCP embryonic count to host = 0
    TCP intercept watermark = unlimited
    UDP flow count/limit = 0/unlimited
  Conn:
    TCP outside 1.1.1.1:23 inside 2.2.2.2:28826, idle 0:00:21, bytes 149, flags UIO
Interface outside: 1 active, 1 maximum active, 0 denied
local host: <1.1.1.1>,
    TCP flow count/limit = 1/unlimited
    TCP embryonic count to host = 0
    TCP intercept watermark = unlimited
    UDP flow count/limit = 0/unlimited
  Conn:
    TCP outside 1.1.1.1:23 inside 2.2.2.2:28826, idle 0:00:21, bytes 149, flags UIO
ciscoasa(config)# packet-tracer input inside tcp 2.2.2.2 28826 1.1.1.1 23    
Phase: 1
Type: FLOW-LOOKUP
Subtype:
Result: ALLOW
Config:
Additional Information:
Found flow with id 15, using existing flow
Result:
input-interface: inside
input-status: up
input-line-status: up
Action: allow
ciscoasa(config)# sh conn
1 in use, 1 most used
TCP outside 1.1.1.1:23 inside 10.10.10.1:31862, idle 0:00:18, bytes 149, flags UIO
ciscoasa(config)# sh xlate
2 in use, 3 most used
Flags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twice
TCP PAT from inside:2.2.2.2 23-23 to outside:3.3.3.3 23-23
    flags sr idle 2:15:10 timeout 0:00:00
TCP PAT from inside:10.10.10.1 8080-8080 to outside:3.3.3.3 80-80
    flags sr idle 2:15:10 timeout 0:00:00
ciscoasa(config)# sh local-host
Interface management: 0 active, 0 maximum active, 0 denied
Interface inside: 1 active, 2 maximum active, 0 denied
local host: <10.10.10.1>,
    TCP flow count/limit = 1/unlimited
    TCP embryonic count to host = 0
    TCP intercept watermark = unlimited
    UDP flow count/limit = 0/unlimited
  Conn:
    TCP outside 1.1.1.1:23 inside 10.10.10.1:31862, idle 0:00:36, bytes 149, flags UIO
Interface outside: 1 active, 1 maximum active, 0 denied
local host: <1.1.1.1>,
    TCP flow count/limit = 1/unlimited
    TCP embryonic count to host = 0
    TCP intercept watermark = unlimited
    UDP flow count/limit = 0/unlimited
  Conn:
    TCP outside 1.1.1.1:23 inside 10.10.10.1:31862, idle 0:00:36, bytes 149, flags UIO
ciscoasa(config)# packet-tracer input inside tcp 10.10.10.1 31862 1.1.1.1 23
Phase: 1
Type: FLOW-LOOKUP
Subtype:
Result: ALLOW
Config:
Additional Information:
Found flow with id 17, using existing flow
Result:
input-interface: inside
input-status: up
input-line-status: up
Action: allow
Thanks