topic HiThrough some trial and in Network Security

ASA 9.3 reverse NAT

hoffa2000 — Tue, 12 Mar 2019 06:01:09 GMT

Hi folks

Can ASA do "reverse NAT"? Vendors have different names for this but what I want to do is have my ASA translate incoming traffic from Internet to an internal IP but have the traffic appear to the internal server as coming from the internal interface of the ASA.

Regards

Fredrik

What do you mean by "comming

Stefan Menning — Fri, 29 May 2015 11:59:38 GMT

What do you mean by "comming from the internal Interface of the ASA"? Do you want the internal Server to see a soure ip from the same Network that asa internal Interface is in? Or do you want the source address to be the actual asa interal Interface ip?

Generally you should be albe to acomplish this task with "twice NAT" (http://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/firewall/asa_91_firewall_config/nat_rules.html), but I'm not sure if it works with the asa-interface-ip.

Hi Stefan. Thank you for the

hoffa2000 — Fri, 29 May 2015 12:02:59 GMT

Hi Stefan. Thank you for the pointer. It doesn't have to be the same IP as the ASA internal interface, could be any available IP on the internal network. I'll take a look at the twice NAT concept.

/Fredrik

HiThrough some trial and

hoffa2000 — Wed, 03 Jun 2015 05:24:55 GMT

Through some trial and erroring I managed to get it up and running. The below command allow any external IP to send email to my internal server using the firewall internet interface IP, the connection is then sent to my mail server using the firewall internal interface IP as source.

nat (outside,inside) source dynamic any interface destination static interface Internal-IP-Of-Server service SMTP SMTP

Great stuff!