topic Re: Source Based Destination NAT in FTD in Network Security

Source Based Destination NAT in FTD

MSJ1 — Thu, 16 Jan 2025 20:06:05 GMT

Problem Details:

Configured 2 Destination NAT as per below

nat (Inside,Outside) source static 10.8.55.229 199.19.3.64 unidirectional
nat (Inside,Outside) source static 10.8.55.229 199.19.5.67 unidirectional

Following plan below configured above 2 lines.

1. if Source is 199.19.3.63 ( this IP at other side of the Site to Site VPN - A Side ) then at B Side of the VPN DNAT will be 199.19.3.64 to 10.8.55.229
2. if Source is 199.19.5.67 ( this IP at other side of the Site to Site VPN - A Side ) then at B Side of the VPN DNAT will be 199.19.5.68 to 10.8.55.229

So Original Destination is same for both NAT statement at B Side. So my question is how do I define each Source in each NAT Line ? Is it doable ?

Re: Source Based Destination NAT in FTD

paul driver — Fri, 17 Jan 2025 09:33:00 GMT

Hello

@MSJ1 wrote:

1. if Source is 199.19.3.63 ( this IP at other side of the Site to Site VPN - A Side ) then at B Side of the VPN DNAT will be 199.19.3.63 to ~~10.8.55.229~~ 199.19.3.64
2. if Source is 199.19.5.67 ( this IP at other side of the Site to Site VPN - A Side ) then at B Side of the VPN DNAT will be 199.19.5.68 to ~~10.8.55.229~~ 199.19.5.67

The return traffic from B side should not be aware of 10.8.55.x so any return traffic will be to 199.19.3.64/67

@MSJ1 wrote:99.19.5.68 to 10.8.55.229
So Original Destination is same for both NAT statement at B Side. So my question is how do I define each Source in each NAT Line ? Is it doable ?

Edited: apologies my question was not clear-
Do you mean translation based on source & destination address ?

example below
object network insidehost
host 10.8.55.229

object network destinationhost1
host 199.19.3.63

object network destinationhost2
host 199.19.3.68

object network natip1
host 199.19.3.64

object network natip2
host 199.19.3.67

nat (inside,out) source static insidehost natip1 destination static destinationhost1 destinationhost1
nat (inside,out) source static insidehost natip2 destination static destinationhost2 destinationhost2

Re: Source Based Destination NAT in FTD

MHM Cisco World — Fri, 17 Jan 2025 09:13:19 GMT

nat (out,in) source static remoteLAN1 remoteLAN1 destination static <mapp server IP1> <real IP>

nat (out,in) source static remoteLAN2 remoteLAN2 destination static <mapp server IP2> <real IP>

MHM