topic Re: Dynamic NAT for internet access, best practice to use outside interface IP or different IP then interface? in Network Security

Dynamic NAT for internet access, best practice to use outside interface IP or different IP then interface?

Jack G — Tue, 11 May 2021 14:31:04 GMT

I generally I see the outside interface IP used for the dynamic NAT, though after enabling RAVPN, etc. there appears to be a warning in FMC about possible conflict, etc. Is it a best practice to use a different IP than the outside interface for dynamic NAT assuming you have more than 1 public IP to work with?

Re: Dynamic NAT for internet access, best practice to use outside interface IP or different IP then interface?

Rob Ingram — Tue, 11 May 2021 14:36:34 GMT

@Jack G General practice, yes use a unique IP address or pool of IP addresses for outbound Dynamic PAT.

Obviously if you don't have spare IP addresses you won't have that luxury.

Re: Dynamic NAT for internet access, best practice to use outside interface IP or different IP then interface?

Marvin Rhoads — Tue, 11 May 2021 14:38:05 GMT

Neither way is more or less secure than the other.

As far as best practices, from an engineering point of view you want to make sure the dynamic NAT/PAT has enough resources for the potential clients. If you have more than a couple hundred devices that will be using the NAT, then it's advised to use a larger address pool.

Re: Dynamic NAT for internet access, best practice to use outside interface IP or different IP then interface?

Jack G — Tue, 11 May 2021 14:57:07 GMT

Understood, thank you. The main issue appeared to be with IPSec. A device on the inside was trying to make a IPSec connection out and couldn’t due conflict, I think it was related to ISAKMP 500...?Ended up creating a static NAT with an different public IP for that device which resolved the issue. I think it was

Re: Dynamic NAT for internet access, best practice to use outside interface IP or different IP then interface?

Rob Ingram — Tue, 11 May 2021 15:02:28 GMT

@Jack G If the outbound IPSec connection from the inside was translated behind the ASA interface IP address and the ASA's outside interface itself was listening on udp/500, then yes I can imagine why that would not have worked. Your static NAT using a different public IP address was the correct way to resolve it.