topic Dynamic Interface NAT on Transparent ASA in Network Security

Dynamic Interface NAT on Transparent ASA

lcaruso — Tue, 12 Mar 2019 00:51:57 GMT

Hi,

I need NAT setup as it would be on Routed ASA where addresses arriving on the inside interface are hidden from outside via dynamic interface NAT.

Is that possible in Transparent Mode? This document doesn't discuss Dynamic NAT.

www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/cfgnat.html#wp1102744

Dynamic Interface NAT on Transparent ASA

Julio Carvajal — Thu, 24 Jan 2013 17:26:28 GMT

Hello,

Yes, it can be done.

No problem at all.

Regards,

Dynamic Interface NAT on Transparent ASA

lcaruso — Thu, 24 Jan 2013 18:33:12 GMT

Thanks.

Is there a more up-to-date reference for 9.x ASAs and Transparent mode?

Dynamic Interface NAT on Transparent ASA

Julio Carvajal — Thu, 24 Jan 2013 18:38:04 GMT

http://www.cisco.com/en/US/docs/security/asa/asa90/configuration/guide/interface_complete_transparent.html

Remember to rate all of the helpful posts..

Dynamic Interface NAT on Transparent ASA

lcaruso — Thu, 24 Jan 2013 18:55:47 GMT

Appreciate the link.

Dynamic Interface NAT on Transparent ASA

lcaruso — Fri, 25 Jan 2013 21:07:55 GMT

Can it do PAT?

The links I have read say no.

Re: Dynamic Interface NAT on Transparent ASA

Julio Carvajal — Fri, 25 Jan 2013 21:13:21 GMT

Note:

Starting with ASA/PIX 8.0(2), NAT/PAT is supported in the transparent firewall. Refer to

NAT in Transparent Mode

for more information.

You can use PAT but not with the ASA interfaces as there is no IP assigned to it.

Re: Dynamic Interface NAT on Transparent ASA

lcaruso — Fri, 25 Jan 2013 21:27:54 GMT

It says (bullet point #4)

Because the transparent firewall does not have any interface IP addresses, you cannot use interface PAT.

So you can use PAT but it's not interface PAT. That means any public servers could not be published on an ASA in Transparent mode, right?

Re: Dynamic Interface NAT on Transparent ASA

Julio Carvajal — Fri, 25 Jan 2013 21:39:34 GMT

No,

It means that you cannot use PAT while intenting to use the interface ip address but you could use any other.

Example

static (inside,outside) tcp 2.2.2.2 80 192.168.12.2.2 80

This will work....

Regards,

Only remember that you cannot try to use the keyword interface ( because there is no ip asssigned to any of the interfaces, that is all )

Remember to rate all of the helpful posts