topic PAT over IPSEC connection to remote site in Network Security

PAT over IPSEC connection to remote site

Anuar Shahrin — Tue, 12 Mar 2019 09:00:04 GMT

Hi All,

I need an advice here on a setup for Cisco ASA.

Is there any possibility to perform a PAT from Public IP to an IP that is located in the firewall in remote site which connected to HQ ASA via IPSEC?

Attached is the diagram of the setup.

Thank you in advance.

Yes, but there is a lot of

Philip D'Ath — Thu, 02 Mar 2017 09:07:50 GMT

Yes, but there is a lot of complicated configuration involved.

Hi philip,

Anuar Shahrin — Thu, 02 Mar 2017 09:41:20 GMT

Hi philip,

Is there any documentation that I can refer to?

I've this setup being use but with different firewall vendor. so I want to know how to do it in Cisco ASA.

I went throug their configuration. Its seems like a straight forward mapping from Public IP <> Private IP behind the other Firewall.

You need to read up about

Philip D'Ath — Thu, 02 Mar 2017 09:43:24 GMT

You need to read up about outside to outside NAT. You'll probably have to use intra-interface as well.

As Philip already mentioned,

Karsten Iwen — Thu, 02 Mar 2017 09:50:56 GMT

As Philip already mentioned, this is a quite complicated setup. I would try to avoid it. My favorite ways to solve these problems are:

Place the server into the headquarter
Place a reverse-proxy into the headquarter that takes the requests from the internet and builds a new connection to the remote server
Use the remote firewall directly to access the server.

Thanks Karsten for the reply.

Anuar Shahrin — Thu, 02 Mar 2017 13:30:31 GMT

Thanks Karsten for the reply.

Unfortunately I do not have much of an option now since the server is located in a cloud provider. The connection to the cloud provider is via the IPSEC tunnel which is going out the same interface.

I guess, my best bet is allow intra-interface/hair pinning the NAT.

Thanks Philip, will look up

Anuar Shahrin — Thu, 02 Mar 2017 13:30:53 GMT

Thanks Philip, will look up on it.