topic Re: PAT using a Different IP from ASA "Outside" Interface in Network Security

PAT using a Different IP from ASA "Outside" Interface

johnlloyd_13 — Thu, 10 Sep 2020 02:50:21 GMT

hi,

quick question, does the IP address for doing dynamic PAT has to be in the same subnet as the ASA "outside" interface?

see sample below. we control the routing for the "outside" network which integrates with a partner network.

interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 100.1.1.1 255.255.255.0

object network OBJ-192.168.1.0-24
nat (inside,outside) dynamic 200.1.1.10

Re: PAT using a Different IP from ASA "Outside" Interface

Rob Ingram — Thu, 10 Sep 2020 06:38:54 GMT

Hi,

Yes that will work. You just need to ensure the upstream router has a route to that IP address/network via the ASA.

HTH

Re: PAT using a Different IP from ASA "Outside" Interface

Ruben Cocheno — Thu, 10 Sep 2020 14:34:36 GMT

@johnlloyd_13

you control the egress, so you can set what IP is going to appear on the outside network, using dynamic PAT for different ranges. In fact thata is a very good strategy. I will assume that you have a default route through that interface.

Youd config looks right.