Twice NAT Overlap

Jared Burton — Tue, 12 Mar 2019 09:10:14 GMT

Hi All,

I have a quick question regarding some twice nat configurations.

I need to know if the following twice nat statement is necessary. (Firewall Spring Cleaning)

Example:

I have a destination in my DMZ that is being natted by yet another Firewall. In this example, the second firewall is obj-dmzhost1, the destination behind the second firewall is 192.168.0.1.

My primary Firewall has a route to the 192.168.0.0 network towards the DMZ.

So I have the following rules:

nat (inside,dmz) source dynamic object-group1 obj-patIP1

nat (inside,dmz) source dynamic object-group1 obj-patIP1 destination static obj-dmzhost1 obj-192.168.0.1

If the first statement is for PATing all sources in object-group1 against obj-patIP1 that is on it's way to anything in the DMZ, is the second statement really necessary? In testing, I don't see a justification for having it as I can reach 192.168.0.1 without the second statement using the first statement.

Just trying to understand when/where and why to use the entirety of the command, as opposed to just the first version.

Thank you in advance everyone!

topic Twice NAT Overlap in Network Security

Twice NAT Overlap