topic NAT question/solution request in Network Security

NAT question/solution request

aaronkite — Tue, 12 Mar 2019 00:34:38 GMT

Hi. I have the following scenario and not sure how to build a NAT for it. Using OS 8.3(2) ASA 5510 secplus lic

I have a device on Outside interface that ONLY can talk to devices on its own broadcast domain, but I have a device on the Inside interface that must be able to talk to this device on the Outside interface. I'm thinking I can set up a NAT for this device on the Inside interface to appear to be on the Outside interface. Networks and hosts below:

interface Ethernet0/0

nameif Inside (routed interface connecting to the trusted side networks)

security-level 100

ip address 192.21.250.92 255.255.255.248

interface Ethernet0/1

nameif outside (layer 2 network with the "outside" interface being the gateway)

security-level 50

ip address 192.14.225.1 255.255.255.128

host 192.14.225.121 (device that can only talk on its own broadcast domain - can't set a default gateway on it)

host 192.51.14.38 (device that 192.14.225.121 needs to be able to talk to, that's coming from the Inside interface)

Can I have the 192.51.14.38 appear to be 192.14.225.5, so that 192.14.225.121 can talk to it? Any other ideas or configurations for a solution would be much appreciated.

Thanks,

Aaron

Re: NAT question/solution request

Jouni Forss — Fri, 07 Dec 2012 16:04:40 GMT

Hi,

Dont you already have some default PAT configuration that does translation for networks behind interface "Inside" to the interface IP address of "outside" which is directly connected as far as host 192.14.225.121 is conserned? Then again looking that both of the networks are public I guess you wouldnt really have need for a PAT configuration between Inside and outside.

If not I guess one solution might be (object names might be better as something else )

object network MAPPED-192.14.225.5

host 192.14.225.5

object network MAPPED-192.14.225.5-DEST

host 194.14.225.121

object network MAPPED-192.14.225.5-SOURCE

host 192.51.14.38

nat (Inside,outside) source static MAPPED-192.14.225.5-SOURCE MAPPED-192.14.225.5 destination static MAPPED-192.14.225.5-DEST MAPPED-192.14.225.5-DEST

Seems a bit complex but should work I guess.

From left to right

Source interface
Destination interface
Static source address
Static mapped address
Static destination address twice as no change regarding its translation is done.

So to my understanding this NAT should only apply for the source host 192.51.14.38 when the destination is 192.14.225.121

- Jouni

NAT question/solution request

aaronkite — Fri, 07 Dec 2012 16:45:52 GMT

Brilliant! works perfectly thanks so much!