topic Re: NAT rule in ASA for Tunnel interface in Network Security

NAT rule in ASA for Tunnel interface

Nitin S — Tue, 19 Jan 2021 15:10:27 GMT

Hello All,

I have configure IPsec VTI tunnel on ASA. i am try to configure NAT rule but interface not showing while adding nat statemen.

Re: NAT rule in ASA for Tunnel interface

Oleg Volkov — Tue, 19 Jan 2021 15:13:22 GMT

What NAT rule you need?

Re: NAT rule in ASA for Tunnel interface

Rob Ingram — Tue, 19 Jan 2021 15:31:02 GMT

@Nitin S

You shouldn't need to...

"VTI eliminates the need to use crypto access lists and Network Address Translation (NAT) exemption rules."

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-firewalls/212478-configure-asa-virtual-tunnel-interfaces.html

If you are having an issue, please run packet-tracer from the CLI and "show nat detail", provide the output from both.

Re: NAT rule in ASA for Tunnel interface

Nitin S — Tue, 19 Jan 2021 15:33:33 GMT

i need NAT rule from INSIDE to VIT_Tunnel.

Re: NAT rule in ASA for Tunnel interface

Oleg Volkov — Tue, 19 Jan 2021 15:35:46 GMT

Ok but why ?

Can You provide full rule ?

It is must be twice nat?

Re: NAT rule in ASA for Tunnel interface

Nitin S — Tue, 19 Jan 2021 15:36:36 GMT

i need NAT rule to do destination NAT & source PAT.

Re: NAT rule in ASA for Tunnel interface

Rob Ingram — Tue, 19 Jan 2021 15:46:37 GMT

@Nitin S

You want to NAT traffic over the route based VPN? Normally when using a route based VPN you just route traffic over the tunnel without NAT, which is probably why the VTI interface does not show when attempting to create NAT rule. You could try "any" when specifying the interface name in a NAT rule.

Re: NAT rule in ASA for Tunnel interface

MHM Cisco World — Tue, 19 Jan 2021 16:58:10 GMT

If I right it is bug

Re: NAT rule in ASA for Tunnel interface

Massimo Baschieri — Mon, 30 May 2022 17:11:58 GMT

Non applicable in all cases thuogh, but the "any" keyword may save your life.

Nat rule that should be entered this way:

nat (VTI,outside) source dynamic RFC1918-1 SRCNAT destination static DSTNETWORK DSTNETWORK

but it's not applicable since VTI interface isn't available, entered this way did the trick to me:

nat (any,outside) source dynamic RFC1918 SRCNAT destination static DSTNETWORK DSTNETWORK

Re: NAT rule in ASA for Tunnel interface

hansrodlo — Wed, 01 Feb 2023 17:02:43 GMT

Thanks, this workaround works for me.

Re: NAT rule in ASA for Tunnel interface

fgfuentes — Thu, 09 Nov 2023 20:16:25 GMT

this workaround actually does the job when using VTI: nat(any,interface)...