topic Hi Ben,You can create STATIC in Network Security

Multiple WAN IP addresses NAT inbound

benford01 — Tue, 12 Mar 2019 06:42:58 GMT

All

This is my first time configuring a ASA and im facing some issues. It seems like im trying to do something basic but i cannot get it to work how i expect.

I have multiple public IP addresses say /29 and im trying to assign them to an interface. Where normally i would assign one address to the interface and have the rest as additional addresses but im struggling to see how i do this on the ASA.

When i try set up a outside - Inside NAT rule using the additional address i have added it says the subnets overlap.

Any help would be much appreciated.

Ben

Hi Ben, You can assign only

Rishabh Seth — Thu, 08 Oct 2015 11:09:06 GMT

Hi Ben,

You can assign only one IP on the ASA interface from a subnet. In case you are using other IP addresses in the subnet to map some internal machines then you can can create NAT statements on ASA.

Please share more details about your setup and let us know what version of ASA software are you using?

Thanks,

R.Seth

Hi R Im using 9.4.2. This is

benford01 — Thu, 08 Oct 2015 11:14:01 GMT

Hi R

Im using 9.4.2.

This is what im trying to do. I have a subnet of /29. I have multiple services that i need to reach from the outside world that are inside. I have done a table below of how would like it to work.

destination address	port	internal address	port
77.88.99.15	9100	10.10.10.1	9100
77.88.99.16	9100	10.10.10.2	9100
77.88.99.17	9100	10.10.10.3	9100

Does this help you understand ?

Ben

Hi Ben,You can create STATIC

Rishabh Seth — Thu, 08 Oct 2015 11:22:58 GMT

Hi Ben,

You can create STATIC NAT on ASA to map a public IP to private IP on a particular port. Once you create NAT you will also require acl to permit traffic for real IP addresses.

Eg:

object network 77.88.99.15
host 77.88.99.15
object network 10.10.10.1
host 10.10.10.1

object network 10.10.10.1
nat (inside,outside) static 77.88.99.15 service tcp 9100 9100

Note: if you are mapping the public IP which is configured on the interface of ASA then use keyword "interface" instead of IP address in your nat statement.

Hope it helps!!!

Thanks,

R.Seth

Don't forget to mark the answer as correct if it helps in resolving your query!!!

Would this not be natting on

benford01 — Thu, 08 Oct 2015 12:16:44 GMT

Would this not be natting on the way from inside to outside ?

Hi Ben, static NAT is

Rishabh Seth — Thu, 08 Oct 2015 12:19:16 GMT

Hi Ben,

static NAT is bidirectional, so it will take care of in to out and out to in traffic.

Thanks,

R.Seth

Thanks Rishabh, I will give

benford01 — Thu, 08 Oct 2015 12:21:47 GMT

Thanks Rishabh, I will give that a go.!

Ben