Static NAT translation order

wilson_1234_2 — Tue, 12 Mar 2019 08:05:31 GMT

We currently have a customer connecting to one of our sites via VPN tunnel.

The Crypto ACL is configured for an internal subnet on our side.

The customer has requested access to a couple of servers in a DMZ, but want to access the servers via the same subnet as the internal subnet on our side.

I believe this can be done with a twice NAT config, but the ASA also has a static one to one NAT of these hosts to a public IP Address.

I am wondering, if since the Twice NAT is translating to a specific destination subnet on their end, if we place the twice NAT above the one-to-one NAT to public IP Address, if it will cause a problem with the one-to-one NAT and cause it to not translate traffic. Here is what I am thinking:

!
object network E_NAT
host 10.9.0.71
!
object network Expressway-E_NAT
host 10.9.9.73

!
Nat (DMZ,Internet) 1 source static E_Normal E_NAT destination static CBTS CBTS route-lookup
!
Nat (DMZ,Internet) 1 source static Expressway-E Expressway-E_NAT destination static CBTS CBTS route-lookup
!

There are also a static one to one NAT translation from DMZ to Internet interface. My question is, since the lines added are first and to a specific destination (CBTS),
Will the below lines still be doing the static one-to-one translation, or will the twice NAT translation cancel out the below translations?

object network E_Normal
nat (DMZ,Internet) static E-Public

object network E_Normal
host 192.168.100.14

object network E-Public
host 1.2.8.123

nat (DMZ,Internet) source static Expressway-E-private Expressway-E-Public

object network Expressway-E-private
host 192.168.100.8

object network Expressway-E-Public
host 1.2.8.125

As the new rules in Section 1

Karsten Iwen — Wed, 03 Aug 2016 22:35:46 GMT

As the new rules in Section 1 have a fixed destination (CBTS), they will not match for general internet traffic that has a NAT-rule in Section 2.

topic As the new rules in Section 1 in Network Security

Static NAT translation order

As the new rules in Section 1