topic Re: Configure NAT on ASA in Network Security

Configure NAT on ASA

Jewgeni Uschegow — Tue, 12 Mar 2019 02:24:54 GMT

Hi Everyone,

I need to configure NAT on Cisco ASA 5520 and NAT has to translate inside ip address to outside ip address with a specific range of ports.

How can I do it?

Regards,

Evgenii

Configure NAT on ASA

Julio Carvajal — Tue, 13 Aug 2013 05:25:14 GMT

Hello,

First of all,

what version are U running?

Check my blog at http:laguiadelnetworking.com for further information.

Cheers,

Julio Carvajal Segura

Configure NAT on ASA

Jewgeni Uschegow — Tue, 13 Aug 2013 05:32:11 GMT

I use the Cisco ASA 5520 with version 8.4(5)

Re: Configure NAT on ASA

Julio Carvajal — Tue, 13 Aug 2013 06:24:58 GMT

Sorry for the long wait

Was creating a blog post just for you,

Check it out at http://www.laguiadelnetworking.com/how-to-create-a-nat-translation-for-a-range-of-ports-on-asa-8-3-and-higher-software/

And let me know what you think

Cheers,

Julio Carvajal Segura

Re: Configure NAT on ASA

Jewgeni Uschegow — Tue, 13 Aug 2013 07:29:36 GMT

Julio, There's good information!

But I need to realisation the following situation:

1. I send packet from A to B

2. ASA does change source ip-address to 10.0.20.1 and change source port to any port form range 2000-2020

3. B sees packet with ip 10.0.20.1 and port 2001

I can't find information how configure this construction=(

Regards,

Evgenii

Configure NAT on ASA

Jouni Forss — Tue, 13 Aug 2013 07:37:01 GMT

Hi,

Just out of interest, why would you want to do so that when a Host A connects to Host B that Host A address should be NATed and also its source port should be NATed to some specific range?

Or did I understand the above situation wrong?

- Jouni

Re: Configure NAT on ASA

Jewgeni Uschegow — Tue, 13 Aug 2013 07:49:19 GMT

Hi Jouni,

I have a few hosts in inside LAN, only one ip-address in outside. And I need to a unique idetification this hosts in outside. Therefore I want to use the range port as identificator.

Re: Configure NAT on ASA

Jouni Forss — Tue, 13 Aug 2013 08:18:40 GMT

Hi,

I have not used such a NAT before personally but I would imagine it would be configured something like this

CONFIGURATION

Source interface LAN
Destination interface WAN
Source host is 10.0.0.150
Destination host is 1.1.1.1
Real source and destination ports is ANY
Mapped Source is the range we want
Mapped destination is ANY (in other words no change for the destination ports as its ANY/ANY)
NAT only applies between these hosts. To include multiple hosts or networks better to use "object-group" instead of "object network"

object network HOST-A
 host 10.0.0.150
object network HOST-B
 host 1.1.1.1
object service REAL-PORTS
 service tcp source range 0 65535 destination range 0 65535
object service MAPPED-PORTS
 service tcp source range 2000 2020 destination range 0 65535
nat (LAN,WAN) source static HOST-A interface destination static HOST-B HOST-B service REAL-PORTS MAPPED-PORTS

TEST

Using "packet-tracer" to confirm that the NAT operates as expected

ASA(config)# packet-tracer input LAN tcp 10.0.0.150 12345 1.1.1.1 1000
Phase: 1
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
nat (LAN,WAN) source static HOST-A interface destination static HOST-B HOST-B service REAL-PORTS MAPPED-PORTS
Additional Information:
NAT divert to egress interface WAN
Untranslate 1.1.1.1/1000 to 1.1.1.1/1000
! Destination parameters are unchanged as per configurations. NAT configuration only applies to destination IP address 1.1.1.1
Phase: 2
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (LAN,WAN) source static HOST-A interface destination static HOST-B HOST-B service REAL-PORTS MAPPED-PORTS
Additional Information:
Static translate 10.0.0.150/12345 to /2018
! Real Source port is translated to one port from Mapped Source range
Phase: 3
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
Phase: 4
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Phase: 5
Type: HOST-LIMIT
Subtype:
Result: ALLOW
Config:
Additional Information:
Phase: 6
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
nat (LAN,WAN) source static HOST-A interface destination static HOST-B HOST-B service REAL-PORTS MAPPED-PORTS
Additional Information:
Phase: 7
Type: USER-STATISTICS
Subtype: user-statistics
Result: ALLOW
Config:
Additional Information:
Phase: 8
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
Phase: 9
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Phase: 10
Type: USER-STATISTICS
Subtype: user-statistics
Result: ALLOW
Config:
Additional Information:
Phase: 11
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 1014220, packet dispatched to next module
Result:
input-interface: LAN
input-status: up
input-line-status: up
output-interface: WAN
output-status: up
output-line-status: up
Action: allow

- Jouni

Re: Configure NAT on ASA

Jewgeni Uschegow — Tue, 13 Aug 2013 08:23:23 GMT

Thank Jouni very much