topic NAT (INSIDE To OUTSIDE) in Network Security

NAT (INSIDE To OUTSIDE)

Navaz Wattoo — Tue, 12 Mar 2019 02:07:17 GMT

I need Configuration of this topology

At Outside Router

int f0/0

ip add 10.1.1.2 255.255.255.0

At Inside Router

int f0/0

ip add 192.168.1.2 255.255.255.0

At ASA

int e0

ip add 10.1.1.1 255.255.255.0

int e1

ip add 192.168.1.1 255.255.255.0

I want NAT from inside to outside and also need ACL configuration and attached diagram.

and version of ASA is 8.2

Navaz

Message was edited by: Navaz Wattoo

NAT (INSIDE To OUTSIDE)

pankaj29in — Fri, 05 Jul 2013 06:52:50 GMT

Static NAT

Nat (inside,outside) 10.1.1.1 192.168.1.1.

Dynamic NAT

nat ( inside) 1 192.168.1.0 255.255.255.0

global (outside) 1 interface --------------- (PAT)

global (outside) 1 10.1.1.1-252 (its depend on your subnet as your /24 in betwen router and firewall)

global (outside) 1 10.1.1.254

ACL requirement depends on your requirement , what exactly you want to achieve, although in this case traffice will traverse from higher to lower so you do not need ACL here.

If you to access from outside to inside ACL would be

access-list Outside_in extended permit tcp any

access-group Outside_in in interface outside.

Regards

Pankaj

NAT (INSIDE To OUTSIDE)

Navaz Wattoo — Fri, 05 Jul 2013 10:49:03 GMT

i need packets from inside to outside

Navaz

Re: NAT (INSIDE To OUTSIDE)

pankaj29in — Fri, 05 Jul 2013 11:09:25 GMT

although in this case traffice will traverse from higher to lower so you do not need an ACL here.

Cisco ASA by deault allow your inside traffic to Outside if your configuration is proper.

Do remember to rate helpful post.

Cheers!!

Pankaj

NAT (INSIDE To OUTSIDE)

Navaz Wattoo — Fri, 05 Jul 2013 11:39:46 GMT

with this confiugration can i send packets from inside to outside?

Navaz

NAT (INSIDE To OUTSIDE)

Navaz Wattoo — Fri, 05 Jul 2013 12:07:52 GMT

THIS MY ASA CONFIGURATION

ciscoasa(config)# sh running-config

: Saved

ASA Version 8.0(2)

hostname ciscoasa

enable password 8Ry2YjIyt7RRXU24 encrypted

names

interface Ethernet0/0

nameif outside

security-level 0

ip address 10.1.1.1 255.255.255.0

interface Ethernet0/1

nameif inside

security-level 100

ip address 192.168.1.1 255.255.255.0

interface Ethernet0/2

shutdown

no nameif

no security-level

no ip address

interface Ethernet0/3

shutdown

no nameif

no security-level

no ip address

interface Ethernet0/4

shutdown

no nameif

no security-level

no ip address

interface Ethernet0/5

shutdown

no nameif

no security-level

no ip address

passwd 2KFQnbNIdI.2KYOU encrypted

ftp mode passive

access-list OUT extended permit tcp any any

pager lines 24

mtu outside 1500

mtu inside 1500

no failover

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

nat-control

global (outside) 1 interface

nat (inside) 1 192.168.1.0 255.255.255.0

static (inside,outside) 10.1.1.1 192.168.1.1 netmask 255.255.255.255

access-group OUT in interface outside

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout uauth 0:05:00 absolute

dynamic-access-policy-record DfltAccessPolicy

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

no crypto isakmp nat-traversal

telnet timeout 5

ssh timeout 5

console timeout 0

threat-detection basic-threat

threat-detection statistics access-list

prompt hostname context

Cryptochecksum:00000000000000000000000000000000

: end

ciscoasa(config)#

THIS MY OUTSIDE ROUTER CONFIGURATION

R1(config)#do sh run

Building configuration...

Current configuration : 877 bytes

version 12.4

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

hostname R1

boot-start-marker

boot-end-marker

no aaa new-model

ip cef

no ip domain lookup

ip domain name lab.local

multilink bundle-name authenticated

interface FastEthernet0/0

ip address 10.1.1.2 255.255.255.0

duplex auto

speed auto

interface FastEthernet0/1

no ip address

shutdown

duplex auto

speed auto

ip route 192.168.1.0 255.255.255.0 10.1.1.1

no ip http server

no ip http secure-server

logging alarm informational

control-plane

gatekeeper

shutdown

line con 0

exec-timeout 0 0

privilege level 15

logging synchronous

stopbits 1

line aux 0

exec-timeout 0 0

privilege level 15

logging synchronous

stopbits 1

line vty 0 4

end

R1(config)#

THIS MY INSIDE ROUTER CONFIGURATION

R2(config)#do sh run

Building configuration...

Current configuration : 880 bytes

version 12.4

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

hostname R2

boot-start-marker

boot-end-marker

no aaa new-model

ip cef

no ip domain lookup

ip domain name lab.local

multilink bundle-name authenticated

interface FastEthernet0/0

ip address 192.168.1.2 255.255.255.0

duplex auto

speed auto

interface FastEthernet0/1

no ip address

shutdown

duplex auto

speed auto

ip route 10.1.1.0 255.255.255.0 192.168.1.1

no ip http server

no ip http secure-server

logging alarm informational

control-plane

gatekeeper

shutdown

line con 0

exec-timeout 0 0

privilege level 15

logging synchronous

stopbits 1

line aux 0

exec-timeout 0 0

privilege level 15

logging synchronous

stopbits 1

line vty 0 4

end

R2(config)#

Navaz

Re: NAT (INSIDE To OUTSIDE)

pankaj29in — Fri, 05 Jul 2013 13:12:53 GMT

static (inside,outside) 10.1.1.1 192.168.1.1 netmask 255.255.255.255

access-group OUT in interface outside

Remove above 2 commands and yes it will work .

Cheers

Pankaj

Remember to rate helpful answers.

NAT (INSIDE To OUTSIDE)

Navaz Wattoo — Thu, 11 Jul 2013 06:14:02 GMT

Thanks a lot

Navaz