ASA Keep host address the same while NATing the network address

derek.small — Fri, 21 Feb 2020 16:08:42 GMT

Does anyone know a way to easily, statically NAT one /24 address to another /24 address, while keeping the host addresses the same. I was thinking something like this, but it doesn't seem to work. I'm trying to avoid configuring a static NAT translation for all 254 addresses on one subnet to the matching 254 addresses on the other subnet.

object network Subnet-inside
host 10.1.1.0 255.255.255.0

object network Subnet-outside
host 10.20.1.0 255.255.255.0

object network Subnet-inside

nat (inside,outside) static Subnet-outside

Re: ASA Keep host address the same while NATing the network address

Rahul Govindan — Fri, 24 Aug 2018 12:39:18 GMT

This should work. You have to change your object to:

object network Subnet-inside
subnet 10.1.1.0 255.255.255.0

object network Subnet-outside
subnet 10.20.1.0 255.255.255.0

Also add an ACL on the outside interface like below:

access-list outside-in extended permit ip any object Subnet-inside

A Sample packet-tracer:

packet-tracer input outside tcp 4.2.2.2 12345 10.20.1.5 4$

Phase: 1
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
object network Subnet-inside
nat (inside,outside) static Subnet-outside
Additional Information:
NAT divert to egress interface inside
Untranslate 10.20.1.5/443 to 10.1.1.5/443

packet-tracer input outside tcp 4.2.2.2 12345 10.20.1.50 $

topic ASA Keep host address the same while NATing the network address in Network Security

ASA Keep host address the same while NATing the network address

Re: ASA Keep host address the same while NATing the network address