topic static translation from dmz to inside on Asa 8.6 in Network Security

static translation from dmz to inside on Asa 8.6

dkemptonmcs — Tue, 12 Mar 2019 00:40:00 GMT

Recently upgraded to an Asa 5512x from a pix 515e. I have an Ipswitch secure MoveIT server on the dmz1 interface that needs to be accessed from both the inside and outside interfaces. I have setup a static nat from the outside to the dmz1 and it works, I can also connect from the inside interface. Now I need the MoveIT server to access the DNS server and email server on the inside interface so it can send notifications. On the pix I just created a static from the inside to the dmz1 using its own IP address - static (inside,dmz1) 192.168.1.7 192.168.1.7 net mask 255.255.255.255. I would then add the access-list to allow. How would I set this up with the Asa 8.6 commands?

Sent from Cisco Technical Support iPad App

static translation from dmz to inside on Asa 8.6

Eugene Korneychuk — Fri, 21 Dec 2012 23:29:22 GMT

Hello Donald,

If you want to have identity nat you can use the following syntax:

nat (inside,dmz1) source static obj-192.168.1.7 obj-192.168.1.7 destinatination static obj-remote-net obj-remote-net

Best Regards,

Eugene

static translation from dmz to inside on Asa 8.6

Peter Koltl — Sat, 22 Dec 2012 14:12:48 GMT

It's a common mistake to forget adding 'route-lookup' and 'no-proxy-arp' to such identity NAT statements. From 8.4 you can experience strange errors if you don't use them.

Re: static translation from dmz to inside on Asa 8.6

dkemptonmcs — Sat, 22 Dec 2012 15:09:10 GMT

Just to make sure, this wouldn't interfere with another static nat I have coming in from the outside to the same internal IP address of 192.168.1.7? It looks like your using twice nat correct?

Sent from Cisco Technical Support iPad App

Re: static translation from dmz to inside on Asa 8.6

Jouni Forss — Sat, 22 Dec 2012 17:34:44 GMT

Hi,

The default operation of the new ASAs/Softwares is that you dont configure NAT if you dont need one.

So if you for example have the following interfaces

outside
lan1
lan2
dmz

If you want the lan1, lan2 and dmz to communicate between eachother with the actual IP addresses, you dont configure any type of NAT between them (even the ones that you used to do with the old software with the "static" commands)

Only situations where I have configured Twice NAT is when I have configured a L2L VPN or there is migrated some old 8.2 or below software Policy NAT.

So to my understanding you would probably have a new type of Static NAT for the dmz1 server towards outside

object network DMZ-STATIC

host 192.168.1.7

nat (dmz1,outside) static x.x.x.x dns

For the same server to communicate with other networks behind the firewall (LAN networks) you shouldnt really need any addiotional NAT configurations. Only have the access-rules permit the traffic if it already doesnt do so.

You can always post some configurations if you want someone to take a look through them.

- Jouni

Re: static translation from dmz to inside on Asa 8.6

dkemptonmcs — Sun, 23 Dec 2012 13:47:45 GMT

Correct, works great. A lot easier to use the new Asa. Just need to learn the syntax. Thank you.

Sent from Cisco Technical Support iPad App