topic Hi,I think the only other in Network Security

Multiple static source NATs to multiple static destination NATs

parsonsproject1 — Tue, 12 Mar 2019 05:07:25 GMT

I have been presented with a NAT scenario that I'm trying to work though, basically it is a src and dst nat like so:

nat (inside,outside) source static src1-original src1-translated destination static dst1-original dst1-translated

The twist is there are a large number of (random) source nats, over 100 of them, so it then looks like so:

nat (inside,outside) source static src1-original src1-translated destination static dst1-original dst1-translated

nat (inside,outside) source static src2-original src2-translated destination static dst1-original dst1-translated

nat (inside,outside) source static src3-original src3-translated destination static dst1-original dst1-translated

Now the plot thickens... they also have 100+ random dst NATs we need to account for... for an example of 3 servers on each side, that's 9 lines of nat:

nat (inside,outside) source static src1-original src1-translated destination static dst1-original dst1-translated

nat (inside,outside) source static src2-original src2-translated destination static dst1-original dst1-translated

nat (inside,outside) source static src3-original src3-translated destination static dst1-original dst1-translated

nat (inside,outside) source static src1-original src1-translated destination static dst2-original dst2-translated

nat (inside,outside) source static src2-original src2-translated destination static dst2-original dst2-translated

nat (inside,outside) source static src3-original src3-translated destination static dst2-original dst2-translated

nat (inside,outside) source static src1-original src1-translated destination static dst3-original dst3-translated

nat (inside,outside) source static src2-original src2-translated destination static dst3-original dst3-translated

nat (inside,outside) source static src3-original src3-translated destination static dst3-original dst3-translated

If we get up to 100 servers on each side, a static mesh of these NATs gets up to 10000 lines of NAT. Eeek! I've been trying to lab out other ways to do this more effectively but am stumped. Is there a better way to go about this?

Thanks!

If I can have it evaluate NAT

parsonsproject1 — Fri, 21 Nov 2014 22:43:02 GMT

If I can have it evaluate NAT two different times that could help reduce it to 200 lines if there are 100 servers on each side. The first pass-through does the src translation:

nat (inside,outside) source static src1-original src1-translated destination static dst-subnet-original dst-subnet-original

nat (inside,outside) source static src2-original src2-translated destination static dst-subnet-original dst-subnet-original

nat (inside,outside) source static src3-original src3-translated destination static dst-subnet-original dst-subnet-original

After the source is translated then the second pass-through evaluates does the dst translation:

nat (inside,outside) source static src-subnet-translated src-subnet-translated destination static dst1-original dst1-translated

nat (inside,outside) source static src-subnet-translated src-subnet-translated destination static dst2-original dst2-translated

nat (inside,outside) source static src-subnet-translated src-subnet-translated destination static dst3-original dst3-translated

Hi,I think the only other

Vibhor Amrodia — Sat, 22 Nov 2014 09:26:40 GMT

Hi,

I think the only other possible way to reduce the NAT statements would be to use the object groups in the NAT statements.

Object-group network source

object src1

object src2

object src3

Object-group network destination

object dest1

object dest2

object dest3

nat (inside,outside) source static source source-translated destination static destination-translated destination

Thanks and Regards,

Vibhor Amrodia

Thank you Vibhor that worked

parsonsproject1 — Mon, 24 Nov 2014 16:05:21 GMT

Thank you Vibhor that worked as expected during my testing! Using object-groups if it finds a match on let's say line 43 of the original source, it will go to line 43 for the translated-source object-group. So as long as the original source and translated source line up on the same lines between the two object groups, that works!

Thanks again!