topic Here I am considering that in Network Security

NAT solution

mynetwork014 — Tue, 12 Mar 2019 07:35:26 GMT

Hi,

PFA, I need to add inside network 192.168.1.100-110(10 host) of ASA1 into DMZ(10.20.1.100) of ASA2 for application.

is it possible to achieve it using NAT on ASA1 firewall.

Please help me to write NAT configuration on firewall.

Hello...

Sergio Ceron Ramirez — Wed, 06 Apr 2016 21:10:18 GMT

Hello...

ASA1 should first know how to get into DMZ network behind ASA2. If you already have this routing properly, and want your source to keep as original, you can use twice NAT as follows:

ASA1 config

object-group network obj_192.168.1.100-110

network-object host 192.168.1.100

... (add all hosts on the range you want)

network-object host 192.168.1.110

object network obj_10.20.1.100_DMZ

host 10.20.1.100

nat (inside,outside) source static obj_192.168.1.100-110 obj_192.168.1.100-110 destination static obj_10.20.1.100_DMZ obj_10.20.1.100_DMZ

ASA2 config:

object-group network obj_192.168.1.100-110

network-object host 192.168.1.100

... (add all hosts on the range you want)

network-object host 192.168.1.110

object network obj_10.20.1.100_DMZ

host 10.20.1.100

nat (inside,DMZ) source static obj_192.168.1.100-110 obj_192.168.1.100-110 destination static obj_10.20.1.100_DMZ obj_10.20.1.100_DMZ

Let me know if it helps. If needed, attach your configs.

Cheers!

Here I am considering that

kkhapeka — Fri, 08 Apr 2016 02:36:51 GMT

Here I am considering that you want to translate 192,169.1.100-110 range of IP address into 10.20.1.100-110 raneg if IP addresses so that application existing in subnet 10.20.1.0/24 can access network behind ASA-1 as their local network.

NAT configuration :-

ASA-1>>

object network obj-192.168.1.100-110
range 192.168.1.100 192.168.1.110
object network obj-10.20.1.100-110
range 10.20.1.100 10.20.1.110

nat (outside,inside) source static any any destination static obj-10.20.1.100-110 obj-192.168.1.100-110

ASA-2>>

object network obj-10.20.1.100-110
range 10.20.1.100 10.20.1.110
object network obj-192.168.1.100-110
range 192.168.1.100 192.168.1.110

nat (inside,outside) source static any any destination static obj-10.20.1.100-110 obj-192.168.1.100-110

--------END OF CONFIGURATION----------

As per the above natting configuration, application located in ASA-2 network will be able to access 192.168.1.100-110 network located in ASA-1 network through local subnet of 10.20.1.100-110.

Thanks for explanation.

mynetwork014 — Sat, 09 Apr 2016 19:39:45 GMT

Thanks for explanation.

I will inform you once i do with this configuration.

Did you get it working?

Sergio Ceron Ramirez — Wed, 18 May 2016 19:07:34 GMT

Did you get it working?