topic Does anything change if you in Network Security

ASA 8.4 - NAT

Mihira Bandara — Tue, 12 Mar 2019 06:32:51 GMT

HI Guys

Can you please help me with this.

I've got an ASA (8.4), in a setup like in the bellow diagram. It has only 2 interfaces INSIDE and OUTSIDE , no dedicated Management interfaces.

I need log into the FW for Management, from the Management PC (192.168.2.1) by Telnetting (or SSH) to 172.31.16.12 (this IP doesn't belong to any interfaces). I don't want to access the FW by 10.1.2.1. Trust me I've got a valid reason for this.

So, I'm looking for the proper way to do this NAT.

I tried bellow. But doesn't work

nat (inside, inside) source static obj-192.168.2.1 obj-192.168.2.1 destination static obj-172.31.16.12 obj-10.1.2.1

same-security-traffic permit intra-interface

I even tried the other way around. But no luck.

nat (inside, inside) source static obj-10.1.2.1 obj-172.31.16.12 destination static obj-192.168.2.1 obj-192.168.2.1

Really appreciate if you can shed some light.

did you try for intra

pjain2 — Fri, 04 Sep 2015 16:23:37 GMT

did you try for intra-interface:

same-security-traffic permit intra-interface

Yes, I did

Mihira Bandara — Fri, 04 Sep 2015 21:33:02 GMT

Yes, I did

This can not be done in this

Marius Gunnerud — Fri, 04 Sep 2015 22:16:34 GMT

This can not be done in this way. You can not access an ASA on an interface other than the ingress interface, the exception being when managing an ASA through a VPN. You would need to set up a VPN to the ASA and then configure management-interface <interface name>.

You would also need to specify what subnet / IP is allowed to manage the ASA as well as the ingress interface that IP will manage the ASA on.

The nat (inside,inside) will not work because you are just hairpinning traffic. You are sending traffic to a destination interface and not "to the box".

Please remember to select a correct answer and rate helpful posts

Does anything change if you

cmlozano8 — Sat, 05 Sep 2015 01:32:30 GMT

Does anything change if you put the "route-lookup" keyword after your static nat?

What does the "packet trace" command show when you simulate this?

route-lookup will not solve

Marius Gunnerud — Sat, 05 Sep 2015 10:11:14 GMT

route-lookup will not solve this specific issue for to the box traffic. This will just tell the ASA to reference the routing table for the egress interface.

As I mention above, what Mihira wants to do is not possible and the best alternative solution is to setup a VPN from the 192.168.2.1 PC to the ASA and then SSH to an interface other than the inside interface.

Please remember to select a correct answer and rate helpful posts