topic Thanks for your help. Mike in Network Security

NAT clairifcation for VPN

burleyman — Tue, 12 Mar 2019 05:56:40 GMT

Please correct me if I am wrong.

For site-2-site VPN's and client VPN access into the private LAN and from the private LAN to the VPN clients and sites, I do not need to configure No NAT with the newer 9.x ASA software.

The older (Pre 8.3) No NAT for this would have been....

access-list 100 extended permit ip 10.10.1.0 255.255.255.0 192.168.10.0 255.255.255.0

nat (inside) 0 access-list 100

Now with ASA 9.x, or more accurately 8.3 and newer... I would not need to configure anything for NAT with this......correct.

Mike

It depends. If you still have

Karsten Iwen — Thu, 14 May 2015 21:13:40 GMT

It depends. If you still have NAT from your LAN to the outside network (typically you have), then you also have to configure NAT exemption on ASA v8.3+.

It's done with twice-NAT in Section 1 of the NAT rules.

That is what I thought but I

burleyman — Fri, 15 May 2015 13:27:22 GMT

That is what I thought but I had someone telling me I did not, but I think he was confused.

So if I have a subnet of 10.10.10.0/24 for Site A and a subnet of 172.16.100.0/24 for Site B I would configure this in Sites A ASA

object network NET-10.10.10.0_24
subnet 10.10.10.0 255.255.255.0

object network NET-172.16.100.0_24
subnet 172.16.100.0 255.255.255.0

nat (inside,outside) source static NET-10.10.10.0_24 NET-10.10.10.0_24 destination static NET-172.16.100.0_24 NET-172.16.100.0_24

Mike

Yes, that's the way to

Karsten Iwen — Fri, 15 May 2015 13:41:07 GMT

Yes, that's the way to configure it. But also add the keyword "no-proxy-arp route-lookup" to the end of the NAT-satement as it can avoid problems in many situations. And if there are other nat-statements in section one, you probably want to have it at the beginning:

nat (inside,outside) 1 source static NET-10.10.10.0_24 NET-10.10.10.0_24 destination static NET-172.16.100.0_24 NET-172.16.100.0_24 no-proxy-arp route-lookup

MikeYes, that is a NAT

Jon Marshall — Fri, 15 May 2015 13:42:45 GMT

Thanks for your help. Mike

burleyman — Fri, 15 May 2015 14:12:43 GMT

Thanks for your help.

Mike