topic Re: NAT/PAT question in Network Security

NAT/PAT question

startx001 — Mon, 23 Sep 2019 15:18:07 GMT

Hi,

How to nat all ip's from lan to one public for access to internet?

Is command correct without "pat-pool" ? . i dont want to get exhausted message.

ASA version 9.10

object network obj-public

host 5.5.5.5

object network obj-lan

subnet 10.10.10.0 255.255.255.0

nat (inside,outside) dynamic obj-public

OR i need to add command "pat-pool"

object network obj-lan

subnet 10.10.10.0 255.255.255.0

nat (inside,outside) dynamic pat-pool obj-public

balaji.bandi — Mon, 23 Sep 2019 15:31:46 GMT

As per my understand you looking to NAT from inside LAN IP pool to go out using 1 Public IP ?

if yes then you need NAT.

If you looking from Internet access you local resource using 1 Public IP, then you need PAT here. (for many different ports to be mapped).

if this is not the case more clarify required here.

startx001 — Mon, 23 Sep 2019 15:34:20 GMT

Loacl lan to access to internet using one public ip.

Rob Ingram — Mon, 23 Sep 2019 15:46:58 GMT

Hi,
Use the syntax below to NAT LAN subnet "obj-lan" behind the "obj-public" IP address:-

nat (inside,outside) source dynamic obj-lan obj-public

HTH

balaji.bandi — Mon, 23 Sep 2019 15:54:30 GMT

you already object group :

nat (inside,outside) source dynamic obj-lan obj-public

startx001 — Mon, 23 Sep 2019 15:56:16 GMT

but its same like nat under object, right?

object network obj-lan

subnet 10.10.10.0 255.255.255.0

nat (inside,outside) dynamic obj-public

Rob Ingram — Mon, 23 Sep 2019 16:17:48 GMT

Ok, yes you can of course define the NAT under the object "obj-lan" that would also work.

balaji.bandi — Mon, 23 Sep 2019 16:24:40 GMT

agreed with @Rob Ingram