topic Hi in Network Security

NAT help

mjsully — Tue, 12 Mar 2019 09:38:00 GMT

Have an ASA5520 running 9.17 code. It currently has the following NAT statement in it:

object network obj-10.10.1.1
nat (inside,DMZ) static 172.252.252.252

I have a need where I need this 10.10.1.1 host to be able to communicate with 2 specific hosts on the DMZ, but NOT get translated when doing so. The 2 hosts have IP's of 192.168.1.1 and 192.168.1.2. Not sure the config or type of NAT to do this nor am I sure the order of operations on which will take place first. I only want it not to translate going to the 2 hosts, the rest of the time I want it to keep getting translated to 172.252.252.252. Help appreciated. thank you

Hi

Francesco Molino — Wed, 28 Jun 2017 05:04:02 GMT

You can create 2 nat exemption for that.

Object network obj-192.168.1.1

Host 192.168.1.1

!

Object network obj-192.168.1.2

Host 192.168.1.2

!

nat (Inside,DMZ) source static obj-10.10.1.1 obj-10.10.1.1 destination static obj-192.168.1.1 obj-192.168.1.1 no-proxy-arp route-lookup

!

nat (Inside,DMZ) source static obj-10.10.1.1 obj-10.10.1.1 destination static obj-192.168.1.2 obj-192.168.1.2 no-proxy-arp route-lookup

hope that helps.

Thanks

PS: Please don't forget to rate and mark as correct answer if this answered your question

Thank you. That helps. One

mjsully — Wed, 28 Jun 2017 14:15:45 GMT

Thank you. That helps. One more follow up, I can do that same NAT and use a source subnet also, right? meaning if I decided I wanted everything on 10.10.1.0/24 subnet to NOT get translated when talking to 192.168.1.1 and 192.168.1.2, could I just change the statements to the following:

object network obj-10.1.1.0
subnet 10.10.1.0 255.255.255.0

nat (Inside,DMZ) source static obj-10.10.1.0 obj-10.10.1.0 destination static obj-192.168.1.1 obj-192.168.1.1 no-proxy-arp route-lookup

nat (Inside,DMZ) source static obj-10.10.1.0 obj-10.10.1.0 destination static obj-192.168.1.2 obj-192.168.1.2 no-proxy-arp route-lookup

Hi

Francesco Molino — Wed, 28 Jun 2017 15:16:22 GMT

Yes you can.

Thanks

PS: Please don't forget to rate and mark as correct answer if this answered your question

And this is what we call

B. BELHADJ — Mon, 03 Jul 2017 12:41:59 GMT

And this is what we call Identity NAT. Please further informations on this link: http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/nat_bypassing.html