topic Re: Cisco ASA NAT Pool/PAT in Network Security

Cisco ASA NAT Pool/PAT

johnlloyd_13 — Wed, 14 Feb 2024 07:54:08 GMT

hi,

i have 2 private IP that would need to configure to a NAT pool of /29 public IP.

can someone confirm if below config is correct?

do i need to add the "flat" keyword to "PAT" using 1024-65535 dynamic ephemeral ports or this is automatic?

will both private IP range "exhaust" all PAT ports on the first IP 200.1.1.1 before going to the next IP 200.1.1.2 and so on?

object network OBJ-PUBLIC-IP-POOL
range 200.1.1.1 200.1.1.6

object network OBJ-10.0.0.16-29
subnet 10.0.0.16 255.255.255.248
nat (inside,outside) source dynamic OBJ-PUBLIC-IP-POOL

object network OBJ-10.2.0.0-16
subnet 10.2.0.0 255.255.0.0
nat (inside,outside) source dynamic OBJ-PUBLIC-IP-POOL

Re: Cisco ASA NAT Pool/PAT

Rob Ingram — Wed, 14 Feb 2024 08:22:37 GMT

@johnlloyd_13 I assume you require Dynamic PAT, in which case you are missing "pat-pool" - this will translate the IP address and ports.

object network LAN 
 nat (inside,outside) dynamic pat-pool IPv4_POOL

In your example you are using Dynamic NAT which translates only the IP address, not the ports.

Re: Cisco ASA NAT Pool/PAT

johnlloyd_13 — Wed, 14 Feb 2024 12:42:38 GMT

hi rob,

if i use the "pat-pool" keyword, would it "exhaust" all dynamic ports (1024 - 65535) on the first public IP on the NAT pool range then use/exhaust the next public IP and so on?

do i need to use the "flat" keyword?

Re: Cisco ASA NAT Pool/PAT

Rob Ingram — Wed, 14 Feb 2024 13:02:50 GMT

@johnlloyd_13 by default all ports for a PAT address will be allocated before the next PAT IP address is used and so on. You can append the keyword "round-robin" to the command syntax, this assigns an address/port from each PAT IP address in the pool before returning to use the first address again, and then the second address, and so on.

No I don't believe you need to use the keyword "flat", you can use "include-reverse" which allocates ports 1-65535.

Re: Cisco ASA NAT Pool/PAT

johnlloyd_13 — Wed, 14 Feb 2024 13:19:03 GMT

hi rob,

one last thing, what if i need to expand/add more public IP in the NAT pool range for the same 10.x.x.x private IP?

and if it's also not in a continuous range? sample scenario below:

object network OBJ-PUBLIC-IP-POOL
range 200.1.1.1 200.1.1.6 <<<< HOW CAN I ADD/SQUEEZE "200.1.1.10 OR 200.1.1.10 - 200.1.1.20

Re: Cisco ASA NAT Pool/PAT

Rob Ingram — Wed, 14 Feb 2024 13:36:10 GMT

@johnlloyd_13 I does not look like you can add another pat-pool to the same object (at least on 9.18), you can failback to an interface though.

ASA(config-network-object)# nat (vlan5,outside) dynamic pat-pool POOL

network-object mode commands/options:
block-allocation Enable port block allocation
extended Extend PAT uniqueness to per destination instead of per interface
flat Translate TCP and UDP ports into flat range 1024-65535
include-reserve Translate TCP and UDP ports into flat range 1-65535
interface Use interface address as mapped IP
round-robin Specify to use PAT ip addresses in round robin instead one by one
<cr>

You could define another object which uses another pat-pool, that uses the different range.

Re: Cisco ASA NAT Pool/PAT

johnlloyd_13 — Wed, 14 Feb 2024 13:42:56 GMT

hi rob,

can you confirm if it's possible to configure as below?

object network OBJ-PUBLIC-IP-POOL-1
range 200.1.1.1 200.1.1.6

object network OBJ-PUBLIC-IP-POOL-2
range 200.1.1.11 200.1.1.20

object network OBJ-10.2.0.0-16
subnet 10.2.0.0 255.255.0.0
nat (inside,outside) source dynamic OBJ-PUBLIC-IP-POOL-1

object network OBJ-10.2.0.0-16
subnet 10.2.0.0 255.255.0.0
nat (inside,outside) source dynamic 200.1.1.10

object network OBJ-10.2.0.0-16
subnet 10.2.0.0 255.255.0.0
nat (inside,outside) source dynamic OBJ-PUBLIC-IP-POOL-2

Re: Cisco ASA NAT Pool/PAT

Rob Ingram — Wed, 14 Feb 2024 13:51:42 GMT

@johnlloyd_13 I am not sure on your example, I was thinking splitting the larger subnet in half and using different pat-pools.

object network OBJ-10.2.0.0-17
subnet 10.2.0.0 255.255.128.0
nat (inside,outside) source dynamic OBJ-PUBLIC-IP-POOL-1

object network OBJ-10.2.0.0-17
subnet 10.2.128.0 255.255.128.0
nat (inside,outside) source dynamic OBJ-PUBLIC-IP-POOL-2

Re: Cisco ASA NAT Pool/PAT

MHM Cisco World — Wed, 14 Feb 2024 15:09:12 GMT

First you can not use two different NAT for same source interface (and same subnet)

The asa not check first one and if it exhausts it check second one

No the asa always check the first NAT

To solve issue of you want to add more public IP to object you can use object-group network have two object one for each pool abd use this object-network in only ONE NAT.

Re: Cisco ASA NAT Pool/PAT

MHM Cisco World — Wed, 14 Feb 2024 14:29:57 GMT

For flat'

If for example there are more than 1000 hosts connect to Inside and all hosts use same known l4 port then using non-flat can exhaust NAT' so solution only for this case use flat NAT.

I see note in cisco doc. Before I will share it here

MHM

Re: Cisco ASA NAT Pool/PAT

Marius Gunnerud — Wed, 14 Feb 2024 15:21:39 GMT

can someone confirm if below config is correct?

The syntax is not correct, when you use the source keyword you need both the real and NATed objects defined in the NAT statement. The way you have it configured now will place the statement into manual NAT / Section 1. Dynamic NAT/PAT statements should be placed in Auto NAT / Object NAT or after-auto NAT.

object network OBJ-PUBLIC-IP-POOL
range 200.1.1.1 200.1.1.6

object network OBJ-10.0.0.16-29
subnet 10.0.0.16 255.255.255.248
nat (inside,outside) after-auto source dynamic OBJ-10.0.0.16-29 OBJ-PUBLIC-IP-POOL

object network OBJ-10.2.0.0-16
subnet 10.2.0.0 255.255.0.0
nat (inside,outside) after-auto source dynamic OBJ-10.2.0.0-16 OBJ-PUBLIC-IP-POOL

do i need to add the "flat" keyword to "PAT" using 1024-65535 dynamic ephemeral ports or this is automatic?

I have never had to use the "flat" keyword, and have had this setup in some large companies without any issues. So, I would say you do not need it.

will both private IP range "exhaust" all PAT ports on the first IP 200.1.1.1 before going to the next IP 200.1.1.2 and so on?

Unless you configure round-robin, all ports for the first public IP will be exhausted before moving on to the next IP in the range.

Re: Cisco ASA NAT Pool/PAT

Marius Gunnerud — Wed, 14 Feb 2024 14:50:12 GMT

@MHM Cisco World The statement "First you can not use two different NAT for same source interface'" is not true for dynamic NAT, it is true for static though and even then it is limited to using the same translated IP and then even further using the same translated port number. In this post we are talking about dynamic NAT which makes this irrelevant.

Re: Cisco ASA NAT Pool/PAT

MHM Cisco World — Wed, 14 Feb 2024 14:53:00 GMT

What make ASA check second NAT if fisrt one is exhausting? Can you try it in lab or share doc.

Thanks alot

MHM

Re: Cisco ASA NAT Pool/PAT

MHM Cisco World — Wed, 14 Feb 2024 15:05:58 GMT

Split subnet can be solution for use two NAT but same subnet and same interface in two NAT using two pool as @johnlloyd_13 shared I DONT think it work.

MHM

Re: Cisco ASA NAT Pool/PAT

Marius Gunnerud — Wed, 14 Feb 2024 15:05:38 GMT

you dont need doc for this one...it is the source IP. first NAT is defined for source 10.0.0.0/16 while the second NAT is defined for 10.2.0.0/16.

Re: Cisco ASA NAT Pool/PAT

MHM Cisco World — Wed, 14 Feb 2024 15:08:24 GMT

Yes friend but @johnlloyd_13 use same subnet

subnet 10.2.0.0 255.255.0.0

That why I reply he can not do that.

Thanks

MHM

Re: Cisco ASA NAT Pool/PAT

Marius Gunnerud — Wed, 14 Feb 2024 15:19:09 GMT

Maybe I am not following what you are trying to point out. Looking at the original post I see two different subnets, 10.0.0.16/29 and 10.2.0.0/16. Using these two as source to NAT to same NAT/PAT pool is possible. The only thing that was wrong in his post was the syntax of the NAT statement (depending on how the NAT statements are to be placed)