topic Re: NAT Exemption in Network Security

NAT Exemption

c.ohliger — Mon, 11 Mar 2019 09:46:05 GMT

Hi,

has anybody tried to implement a NAT exemption and static NAT for the same source. What i want to achieve is that one host of the internal network will be not natted like the complete network and also has a static NAT for another connection.

I have problems to implement this and have read that PNAT is not possible in combination with NAT exemption.

regards

Christoph

Re: NAT Exemption

suschoud — Wed, 14 Mar 2007 14:51:41 GMT

hi,

let's say u have host A on the inside.

You want that when host A goes to 1.1.1.1/24,then it should not be translated ( nat exempt ) and for the rest of the traffic it should get translated. ( static nat ).

is that true ?

if it is,

access-l nonat permit ip host A 1.1.1.1 255.255.255.0

nat (inside) 0 access-list nonat

static (inside,outside)

the nat 0 with an access-list ( exempt ) takes precedence over the static and that's why,the no nat is processed before the static.

i guess that's it.

if i am on the wrong side of the lane,let me know.

Regards,

Sushil.

Re: NAT Exemption

acomiskey — Wed, 14 Mar 2007 14:52:43 GMT

Correct, here's the rest of the order

1. nat exemption

2. static nat

3. static pat

4. policy nat

5. regular nat

Re: NAT Exemption

kaachary — Wed, 14 Mar 2007 14:53:55 GMT

Once a packet is exempted from natting for a specific destination, you can not do static natting for the same host/netowrk for the same destination.

Give us a brief overview of the scenario, and we'll try to help.

-Kanishka

Re: NAT Exemption

c.ohliger — Wed, 14 Mar 2007 15:09:47 GMT

Jesus ... so much answers, thanks for all your help. Its a complex environment, but i will try to explain. The environment is based on a FWSM with several interfaces. Basically all traffic is in a exemption NAT table based on network groups. A remote site will be connected to this environment with IPSEC. The IPSEC part will be handeld by a concentrator. The remote network is 172.22.0.0/16, has to be natted inbound to 10.61.0.0/16. Traffic from internal to this remote network has to natted dynamic (pool). Specific hosts in the internal network has to have a static NAT when accessed from outside.

The problem is the remote site is not willing to do NAT, that would be the easy way...

When i understand your comments correct then is the "jumping point" that NAT exemption is the first in order ... so the only solution would be to build a second firewall for this traffic ,-)

regards

Christoph