topic Re: ASA source NAT for VPN , Local Subnet should NAT with single Public IP in Network Security

ASA source NAT for VPN , Local Subnet should NAT with single Public IP

vasanth.manoharan — Tue, 03 Mar 2020 02:03:41 GMT

Hi All,

I have requirement for the VPN , remote subnet is getting conflict with local VPN subnet so i want to nat the local subnet with 1 public ip address and that public ip address act as a local subnet for my VPN.

Local subnet:-10.10.10.0/24 this should nat with single public ip :-1.1.1.1 ( for example)

Please any experts suggest me , how to achive this..

Re: ASA source NAT for VPN , Local Subnet should NAT with single Public IP

Cristian Matei — Tue, 03 Mar 2020 18:26:42 GMT

Hi,

What is your ASA software version? Also, if you want the local subnet to be able to communicate with the remote subnet (which are the same in the end), you would need to NAT traffic both ways, statically.

Regards,

Cristian Matei.

Re: ASA source NAT for VPN , Local Subnet should NAT with single Public IP

joseph.pj — Tue, 03 Mar 2020 21:09:04 GMT

you can do a static NAT like below as suggested by Cristian;

ip nat inside source static 10.10.10.0/24 1.1.1.1

Re: ASA source NAT for VPN , Local Subnet should NAT with single Public IP

vasanth.manoharan — Wed, 04 Mar 2020 05:23:47 GMT

Hi ,

version of ASA is Version 9.8(4)8.

and i expecting configuration like this , the below nat is for no natting :-

local subnet is 10.10.10.0/24 and 10.10.20.0/24 should nat with public ip address 1.1.1.1

after this no nat will be like below.

nat (T1toASR,outside) source static 1.1.1.1 1.1.1.1 destination static 5.5.5.5/24 5.5.5.5/24

on top of that i want to do the natting for local ip address:- (i.e) 10.10.10.0/24 and 10.10.20.0/24 to one public ip that is 1.1.1.1 my question is how to do the source NAT i confused lot myself.

Re: ASA source NAT for VPN , Local Subnet should NAT with single Public IP

Cristian Matei — Wed, 04 Mar 2020 18:09:10 GMT

Hi,

Do you need to achieve IP connectivity between the two overlapping subnets?

Regards,

Cristian Matei.

Re: ASA source NAT for VPN , Local Subnet should NAT with single Public IP

vasanth.manoharan — Thu, 05 Mar 2020 01:23:10 GMT

Yes, i want to set up a VPN between two overlapping subnet

Re: ASA source NAT for VPN , Local Subnet should NAT with single Public IP

Cristian Matei — Sat, 14 Mar 2020 16:53:20 GMT

Hi,

If you need bidirectional traffic flow, you need to do static NAT, at subnet level. Assuming the overlapping subnet is 10.10.10.0/24:

- you configure left side to NAT 10.10.10.0/24 into 10.11.11.0/24; configure the required objects and replace interface nameifs, but statement looks like nat(inside,outside) 1 source static 10.10.10.0/24 10.11.11.0/24 destination static 10.12.12.0/24 10.12.12.0/24

- you configure right side to NAT 10.10.10.0/24 into 10.12.12.0/24; configure the required objects and replace interface nameifs, but statement looks like nat(inside,outside) 1 source static 10.10.10.0/24 10.12.12.0/24 destination static 10.11.11.0/24 10.11.11.0/24

Regards,

Cristian Matei.