topic Re: NAT on a Stick to and ASA in Network Security

NAT on a Stick to and ASA

vivarock12 — Fri, 12 Jun 2020 22:36:45 GMT

is it posible to translate a Nat on a STICK to an ASA?

Re: NAT on a Stick to and ASA

balaji.bandi — Sat, 13 Jun 2020 10:09:22 GMT

I do not see any issue of deployment method, do you have any failures to deploy?

Re: NAT on a Stick to and ASA

Marius Gunnerud — Sat, 13 Jun 2020 14:08:10 GMT

This is possible so long as you have the command same-security permit intra-interface command configured. Most commonly, in my experience, this is done for RA VPN users that use a tunnel all configuration and require internet access.

Is there a specific scenario you are having issues with? If yes, please provide a more detailed description of the issue so we can help you further.

Re: NAT on a Stick to and ASA

vivarock12 — Sun, 14 Jun 2020 14:04:21 GMT

Well in this case is for reaching a service.

so what i want to do is the folowing in the outside-mpls interface i have the ip adress 10.10.10.2/30,

but the trafic i need to NAT(10.241.120.0/23) is not to that ip address, i need to NAT to one ip address of 10.10.30.13/32(example).

because the other side router only knows the 10.10.30.0/24.

so can this be done?

10.10.10.0/30 172.16.3.0/30

10.10.30.1/29[Core]----[ASA]-.2----------.1-[ISP]-.1-----------.2-[Client]--[Lan X]

10.241.120.0/23

Re: NAT on a Stick to and ASA

Marius Gunnerud — Sun, 14 Jun 2020 17:22:40 GMT

Does the ASA have an interface in the 10.10.30.0/24 network?

Where is the source traffic coming from (source IP)?

So, if I understand correctly, you want to use an IP in the 10.10.10.0/30 as the destination for an IP in the 10.10.30.0/24 network? If this is the case, this is possible. Just make sure that the destination network knows how to route back to the source network.

Re: NAT on a Stick to and ASA

vivarock12 — Mon, 15 Jun 2020 04:43:10 GMT

Does the ASA have an interface in the 10.10.30.0/24 network?

no, the asa haves a l3 conection to the core, the core has the 10.10.30.x/30, for some reason on the other side they alow the 10.10.30/24.so i have to nat to some op of this segment.

so it is posible besides the fact that the asa does not have that ip directly connected?

and if is posible coud you share and example.

and thank by le way.

Re: NAT on a Stick to and ASA

vivarock12 — Tue, 23 Jun 2020 15:49:37 GMT

not sure about nat on stick but i end up doing the following:

auto
!
object network NOC
subnet 10.241.120.0 255.255.255.0
nat (inside,Client_wan) dynamic 10.10.30.15
!

manual
object network NOC
subnet 10.241.120.0 255.255.255.0
!
object network NAT-IP
host 10.10.30.15
!
nat(inside,Client_wan) source dynamic NOC NAT-IP
!

it work in both cases.