Source NAT - ASA

GRANT3779 — Fri, 21 Feb 2020 17:03:41 GMT

Looking at the below - (This could be any addressing and assume all ACLs are in place etc.. for the traffic flow)

interface Gi0/1
nameif WAN
security-level 100
ip address 10.99.0.1 255.255.255.0

interface Gi0/1
nameif DMZ
security-level 50
ip address 192.168.66.1 255.255.255.0

object network OBJ_VENDOR

subnet 192.168.66.0 255.255.255.0

object network OBJ_HIDE

host 10.44.0.1

nat (dmz,wan) source static OBJ_VENDOR OBJ_HIDE no-proxy-arp

If I have the above NAT, when matching traffic leaves this Firewall, does it leave with a source address of the OBJ_HIDE (10.44.0.1) or does it leave the Firewall with the address of the WAN Interface IP (10.99.0.1) ?

Re: Source NAT - ASA

Rob Ingram — Mon, 22 Apr 2019 16:40:58 GMT

Hi,
Assuming you have no other NAT rule with a higher priority which could potentially nat the traffic behind the wan interface, the traffic from the 192.168.66.0/24 network should be natted with 10.44.0.1.

HTH

topic Re: Source NAT - ASA in Network Security

Source NAT - ASA

Re: Source NAT - ASA