topic Re: Static NAT Both Directions ASA 9.8 in Network Security

Static NAT Both Directions ASA 9.8

jtapia0011 — Thu, 09 Jul 2020 23:38:45 GMT

Hello friens I hope you are good.

People I need to make a static Nat for both flow direction inside a VPN Site to site.

This is the configuration

nat (interface inside - interface outside) 1 source static A.A.A.A B.B.B.B destination static Z.Z.Z.Z Z.Z.Z.Z. route-lookup

As you can see source translate and destination are same thats is ok, but what what happend if the destination Z.Z.Z.Z is who want to open the conection to my side, that nat ¿Does it work anyway? I mean Z.Z.Z.Z ----> B.B.B.B A.A.A.A ¿?

----------------------------------------------------------------------------------------------------------------------------------------------------------------------

Apart from this a quick question, when you do a nat with position rule, if there are already several rules

1
2
3
and I create a new one with a number 1 on it that replaces the old number 1 or just lowers it or moves the old number 1 a little lower

thanks a lot

Re: Static NAT Both Directions ASA 9.8

HaroldCalderon — Fri, 10 Jul 2020 13:50:19 GMT

¿someone has had this scenario?

Re: Static NAT Both Directions ASA 9.8

Marius Gunnerud — Fri, 10 Jul 2020 19:31:06 GMT

Yes, this configuration will work in both directions given that this is a single IP and that the remote site accesses the device using the B.B.B.B IP. If this were a dynamic NAT (i.e. you are NATing a whole subnet to a public IP over the VPN) you would need to add a seperate static NAT for the device you want to grant access to.

Apart from this a quick question, when you do a nat with position rule, if there are already several rules

1
2
3
and I create a new one with a number 1 on it that replaces the old number 1 or just lowers it or moves the old number 1 a little lower

If you insert a NAT into position 1, then the other existing rules will be renumbered. For example, existing rule 1 will become rule 2, existing rule 2 will become rule 3, etc.

Re: Static NAT Both Directions ASA 9.8

HaroldCalderon — Fri, 17 Jul 2020 17:24:59 GMT

thanks the order nat working but, the nat reverse no,

This is because I need the destination be nated to other Ip isside my lan , so may be I have to do the nat inside an object network like

Object netowork name

a.a.a.a

(inside,outside) c.c.c.c

Re: Static NAT Both Directions ASA 9.8

HaroldCalderon — Sat, 18 Jul 2020 21:01:38 GMT

Just change the interface, put them in a reverse way

inside,outside

now

outside, inside ( here reverse addess too)

outside inside destination destination original source nat source

thats it

Re: Static NAT Both Directions ASA 9.8

jtapia0011 — Mon, 20 Jul 2020 14:39:55 GMT

This works...