topic Re: Too Many NAT Statements? in Network Security

Too Many NAT Statements?

Justin Lenhart — Tue, 26 Mar 2019 00:49:14 GMT

Is there a cisco best practice on the maximum number of NAT statements on a Cisco ASA? We have a 5520 and a coworker is adding static NAT policies so a vendor can monitor around 1,029 nodes. The problem is each node inside is a 10.X.X.X and to keep the IPs from overlapping with other customers the vendor monitors they would like us to NAT to a 172.16.X.X scheme.

Re: Too Many NAT Statements?

gurpsin2 — Mon, 10 Sep 2012 15:37:29 GMT

Hi Justin,

You can create 2147483647 translation on ASA, which is sufficient for your network setup, however the limit applies to number of ACL's that you can apply and it is platform dependent.

Notice that xlate consumes memory of ASA, so depending upon the RAM available, you could create xlates. Ideally, 256 Bytes are taken per xlate. So, for example, if you have 512 MB on ASA, you could create 262144 xlates.

let me know if you have any questions.

Regards

Gurpreet

Too Many NAT Statements?

Justin Lenhart — Mon, 10 Sep 2012 17:56:15 GMT

Perfect. Thank you!

Too Many NAT Statements?

Jouni Forss — Tue, 11 Sep 2012 06:49:56 GMT

Hi,

If you are configuring a setup with a L2L VPN between you and the vendor for example and you need to NAT your LAN IP addresses to another private IP range you dont necesarily have to do NAT statements for every single device.

Lets say you only had a /24 network full of nodes that need to be monitored, you could for example just NAT 10.10.10.0/24 to for example 172.30.50.0/24

This would mean that 10.10.10.1 would translate to 172.30.50.1. IP address 10.10.10.2 would translate to 172.30.50.2 and so on.

From your original post I got the impression that you were going to do a Static NAT command for each of the host when possibly the same could be achieved with a single NAT command.

The format of the NAT commands ofcourse depends on what software you are running on the ASA (software 8.2 and before OR 8.3 and after)

- Jouni