topic nat outside addr to inside at site reached via mpls in Network Security

nat outside addr to inside at site reached via mpls

john.wright — Tue, 12 Mar 2019 01:23:01 GMT

We are running asa ios 8.4 and would like to know if it possible to nat an outside addr at site A to an inside addr that is reached via mpls at site B?

Re: nat outside addr to inside at site reached via mpls

Jouni Forss — Wed, 03 Apr 2013 13:46:35 GMT

Hi,

I guess the basic format would be something like this

object network PUBLIC-GLOBAL

host 1.1.1.1

object network PUBLIC-LOCAL

host 10.10.10.100

object network LOCAL-LAN

subnet 10.10.10.0 255.255.255.0

nat (inside,outside) source static LOCAL-LAN LOCAL-LAN destiantion static PUBLIC-LOCAL PUBLIC-GLOBAL

Where

PUBLIC-GLOBAL = Is the actual real "outside" IP address
PUBLIC-LOCAL = Is the NATed "outside" IP address when connecting to network LOCAL-LAN. The NAT IP in question is from the same network as "inside"
LOCAL-LAN = Is the network on the "inside"

Though I am not sure if I have understood your setup correctly.

- Jouni

Re: nat outside addr to inside at site reached via mpls

Jouni Forss — Wed, 03 Apr 2013 14:04:11 GMT

Actually,

This might be closer to the truth

object network PUBLIC-GLOBAL

host 1.1.1.1

object network PUBLIC-LOCAL

host 10.10.10.100

object network PUBLIC

host 2.2.2.2

object network LOCAL-LAN

subnet 10.10.10.0 255.255.255.0

nat (inside,outside) source dynamic LOCAL-LAN PUBLIC destiantion static PUBLIC-LOCAL PUBLIC-GLOBAL

Where

PUBLIC-GLOBAL = Is the actual real "outside" IP address
PUBLIC-LOCAL = Is the NATed "outside" IP address when connecting to network LOCAL-LAN. The NAT IP in question is from the same network as "inside"
LOCAL-LAN = Is the network on the "inside"
PUBLIC = Is the public IP visible to the public network for your hosts on the LOCAL-LAN

I configure for example the site www.google.fi to be reachable with the local IP address of 10.0.10.3 from my LAN

object network PUBLIC-GLOBAL

host 173.194.71.94

object network PUBLIC-LOCAL

host 10.0.10.3

object network LOCAL-LAN

subnet 10.0.0.0 255.255.255.0

object network PUBLIC

host x.x.x.x

nat (LAN,WAN) source dynamic LOCAL-LAN PUBLIC destination static PUBLIC-LOCAL PUBLIC-GLOBAL

ASA(config)# sh conn long

TCP WAN:173.194.71.94/80 (10.0.10.3/80) LAN:10.0.0.30/52404 (x.x.x.x/52404), flags UIO, idle 2s, uptime 3s, timeout 1h0m, bytes 2404

- Jouni

nat outside addr to inside at site reached via mpls

john.wright — Wed, 03 Apr 2013 14:09:49 GMT

Jouni

Thanks for the reply

If I understand correctly the

object network PUBLIC-GLOBAL is the mapped addr at site A (I use the term Mapped to indicate it is outside addr provided by an ISP)

The object network PUBLIC-LOCAL

is the real addr (in this case the real addr is at site B) (real is the inside private network addr)

The

object network LOCAL-LAN is the inside LAN of site A.

Our goal is to allow people to access this server from outside via site A even though the server physically sits at site B.

It seems like a crazy request to us but site B is being phased out and this is a way to allow access until the server is moved to site A.

Re: nat outside addr to inside at site reached via mpls

Jouni Forss — Wed, 03 Apr 2013 14:18:05 GMT

Hi,

I think your setup might actually be simpler and the above examples probably aint the thing you are looking for.

So let me see if I now understood this correctly

Site A should provide the public IP address to which users connect to from Internet to reach the Site B server
Site B is connected to Site A with a dedicated connection
Site B is visible to the Site A with a certain private IP address range
You want to NAT a Site A Public IP to a Site B private IP address

To my understanding this should just require a simple Static NAT between your Site A "outside" interface and the Site A ASA interface which leads to the Site B

For example if the following apply

Site A Internet facing interface is "outside"
Site A Site B facing interface is "mpls"
Site B server local IP address is 10.10.10.10
Site A public NAT IP for Site B server is 1.1.1.1

Then you could simply configure

object network STATIC

host 10.10.10.10

nat (mpls,outside) static 1.1.1.1

And naturally would have to make ACL rules on the "outside" interface to allow traffic.

Let me know if this was what you were after.

- Jouni

nat outside addr to inside at site reached via mpls

john.wright — Wed, 03 Apr 2013 15:05:07 GMT

Jouni

You have stated this correctly.

So let me see if I now understood this correctly

Site A should provide the public IP address to which users connect to from Internet to reach the Site B server YES
Site B is connected to Site A with a dedicated connection YES
Site B is visible to the Site A with a certain private IP address range YES
You want to NAT a Site A Public IP to a Site B private IP address YES

We are waiting on this site B to provide us with the addr of the server. As soon as we get that info we are going to code this as you suggested. We will let the fourm community know what the outcome is and rate accordingly.

Re: nat outside addr to inside at site reached via mpls

Jouni Forss — Wed, 03 Apr 2013 15:11:38 GMT

One more question about the setup.

Does Site B have any other Internet connection other than through Site A? In other words, does the Site B have its own Internet connection?

If Site B has its own Internet connection then naturally it will route all traffic coming from public IP addresses out of its own Internet connection and this simple Static NAT wouldnt do the trick and we would actually have to resort to a bit more complicated NAT like in my first replys.

We would both have to

NAT "any" source address behind the "outside" interface of Site A ASA to some PAT address or NAT Pool when they are connecting the public IP address of the Site B server
We would also have to make sure that the Site B would have a route for the above mentioned PAT address / NAT Pool so return routing for the traffic coming from Site A would be correctly forwarded back to the Site A and out its Internet connection.

- Jouni

nat outside addr to inside at site reached via mpls

john.wright — Wed, 03 Apr 2013 15:15:12 GMT

Site B does not have its own internet.

It uses the services of another site C which I guess is being proxied.

nat outside addr to inside at site reached via mpls

Jouni Forss — Wed, 03 Apr 2013 15:19:11 GMT

Where does the Site B default route point to?

Does it point towars Site A or Site C?

- Jouni

nat outside addr to inside at site reached via mpls

john.wright — Wed, 03 Apr 2013 15:34:15 GMT

Site B points to site C for its default route.

nat outside addr to inside at site reached via mpls

Jouni Forss — Wed, 03 Apr 2013 15:51:08 GMT

Ok,

Well that means that in the current setup if we use the Static NAT at Site A then the following will happen

User on the Internet tries to access the Site B server with the Site A public IP address
Connections comes to Site A ASA and the connection/traffic is forwarded to the Site B
Traffic arrives to the Site B server
Server at Site B send the return traffic using the local default route through a different route than the one leading to Site A
Connection will timeout as we are facing assymetric routing

This would mean that we would need to NAT both the Internet users source addresses and the Site B server IP address on the Site A ASA for this to work. We would also need to make sure that the IP address we NAT/PAT all the Internet users is routed from Site B to Site A so the traffic doesnt get sent to Site C like mentioned above.

object network SERVER-LOCAL

host

object network SERVER-PUBLIC

host

object network SERVER-SOURCE-PAT

host

nat (outside,mpls) source dynamic any SERVER-SOURCE-PAT destination static SERVER-PUBLIC SERVER-LOCAL

Furhermore we would need to confirm that the IP address under the SERVER-SOURCE-PAT has a route at Site B pointing towards Site A and therefore doesnt get routed towards Site C.

- Jouni

nat outside addr to inside at site reached via mpls

john.wright — Wed, 03 Apr 2013 16:16:27 GMT

Jouni

I am unsure about one item

object network SERVER-SOURCE-PAT

host

This addr would be our isp provided addr correct?

This is what I have for outside for pat

object network outside

host 31.xx.xx.xxx

Then on the site B side I would need a ip route statement in the L3 switch?

ip route 10.92.3.3 255.255.255.255 31.xx.xx.xxx ?

Re: nat outside addr to inside at site reached via mpls

Jouni Forss — Wed, 03 Apr 2013 16:26:26 GMT

Hi,

The IP address under "object network SERVER-SOURCE-PAT" is a random IP address of your choosing. This will be the IP address to which every host on the Internet is NATed to when they try to access the Site B server using the IP address under the "object network SERVER-PUBLIC" IP address.

The purpose of this Dynamic PAT configuration for all Internet hosts when connecting to Site B server is that we only need a route for this PAT IP address on the Site B pointing to Site A.

Consider the situation where we only do a Static NAT for the Site B server. Site B server will see connections coming to it from the public IP addresses directly which can be basically anything. And naturally return traffic for these connections will follow the default route from the Site B server towards Site C.

Now when we consider the situation where we are doing Dynamic PAT to the Internet hosts on Site A then the Site B server will see all the connections coming to it from only a single PAT IP address and it will be easy to configure return route for that PAT IP address towards Site A and get the connections working.

Hope I made any sense.

- Jouni

Re: nat outside addr to inside at site reached via mpls

Jouni Forss — Wed, 03 Apr 2013 17:03:32 GMT

Hi,

Here is a quick picture I made about the setup. How I understood your situation and how the NAT would work

Click to enlarge

- Jouni

Re: nat outside addr to inside at site reached via mpls

john.wright — Wed, 03 Apr 2013 18:09:17 GMT

Jouni

Thanks for all the help.

The route that I would use on site B pointing back to site A using your map would be this

ip route 10.10.10.10 255.255.255.255 2.2.2.2?

nat outside addr to inside at site reached via mpls

Jouni Forss — Wed, 03 Apr 2013 18:15:05 GMT

Hi,

I still dont know the exact layout of your network.

The only route that the Site B needs is the route which tells where the PAT IP address is located. The PAT IP address that all the Internet users trough Site A are visible from.

So in your situation the route would be something like

ip route 2.2.2.2 255.255.255.255

And naturally the IP address 2.2.2.2 is just an example IP address. You can and probably should use something else.

Also I dont know how many hops there are between the 2 sites so you might need some configurations elsewhere also.

- Jouni

Re: nat outside addr to inside at site reached via mpls

john.wright — Wed, 03 Apr 2013 18:29:07 GMT

Jouni

The routing issue is the thing that makes this not possible. We do not know what may be between A and B. And the routers are managed by a 3rd party.

We don't want to involve the vedor.

However you did answer the origimal question, that nat was possible over an mpls.

Thanks much 5 stars for such a great effor!

nat outside addr to inside at site reached via mpls

Jouni Forss — Wed, 03 Apr 2013 18:36:33 GMT

Again without knowing the setup, here is one option to consider.

Can you share the configuration on the Site A ASA for the interface that is connected to the Site B MPLS connection? I presume its a separate interface from the actual LAN interface of Site A?

I imagine that the link network between your Site A ASA MPLS interface and the router for the MPLS connection is automatically adverticed to the Site B? In other words the Site B server can probably ping the Site A ASA MPLS interface IP address?

If this is correct, then it might be possible to NAT all traffic from Internet of Site A to the MPLS interface IP address when they are connecting to Site B server. This way you wouldnt be adding any new IP address/network to the setup and no new routing would be needed.

But as I said this depends if the Site B server can currently reach the Site A ASA MPLS interface IP address. Does it show in the local routing table of the Site B router?

- Jouni

nat outside addr to inside at site reached via mpls

john.wright — Wed, 03 Apr 2013 18:46:25 GMT

Jouni

Site B knows how to get to site A. I have no idea what is between site A and site B.

This is th addr of the firewall at site Athat I am able to ping from a switch at site B.

GS-CORE#ping 10.51.21.252

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.51.21.252, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms

Re: nat outside addr to inside at site reached via mpls

Jouni Forss — Wed, 03 Apr 2013 18:57:06 GMT

Hi,

So if the Site B and its server can reach the ASA interface then I guess the following configuration might be possible

object network SERVER-LOCAL

host

object network SERVER-PUBLIC

host

nat (outside,mpls) source dynamic any interface destination static SERVER-PUBLIC SERVER-LOCAL

The only difference compared to the previous NAT configuration is that we DONT NAT the hosts on the Internet to a certain PAT address but rather use the "interface" parameter (marked in red) to define that the Internet users will be NATed to the "mpls" interface IP address.

And because Site B seems to be able to reach this IP address the routing should also be fine without any changes.

- Jouni