topic ASA5525X - 8.6(1)2 and One-To-One Static Mapping Issue in Network Security

ASA5525X - 8.6(1)2 and One-To-One Static Mapping Issue

Robert Ho — Mon, 11 Mar 2019 23:51:27 GMT

Just started working with the post 8.3 CLI.

Traffic from outside to inside is translated correctly, but inside to outside is using the outside Interface IP instead of the mapped IP, 50.50.50.50.

I know I'm missing something small here.

This is the config that was build using ASDM.

Outside IP: 50.50.50.50

Inside IP: 10.10.10.10

object network TEST

host 50.50.50.50

description One-To-One NAT 50.50.50.50/10.10.10.10

object network TEST-priv

host 10.10.10.10

description One-To-One NAT 50.50.50.50/10.10.10.10

object network TEST-priv

nat (inside,outside) static TEST

nat (inside,outside) source dynamic IN2OUT interface description PAT Overload Using Interface Public IP

object network IN2OUT

subnet 0.0.0.0 0.0.0.0

description Inside To Outside NAT

Note: ASDM created object TEST-priv twice. One on top and one below the NAT configs.

ASA5525X - 8.6(1)2 and One-To-One Static Mapping Issue

Julio Carvajal — Fri, 07 Sep 2012 16:38:44 GMT

Hello Robert,

The problem here is the nat order.

Twice nat are review first so in order to make this work do the following on the CLI.

no nat (inside,outside) source dynamic IN2OUT interface description PAT Overload Using Interface Public IP

nat (inside,outside) after-auto source dynamic IN2OUT interface description PAT Overload Using Interface Public IP

Remember to rate all of the answers, for the community that is more important that a thank

Regards,

Julio

ASA5525X - 8.6(1)2 and One-To-One Static Mapping Issue

Robert Ho — Fri, 07 Sep 2012 16:49:11 GMT

looks like it is working, thanks!

so, best practice is to create the global nat entry at the very end?

do i still need to do this after creating additional mappings, or is this a one time deal?

ASA5525X - 8.6(1)2 and One-To-One Static Mapping Issue

Julio Carvajal — Fri, 07 Sep 2012 17:02:14 GMT

Hello Robert,

The best practice is to place the general rules at the bottom, the specific ones at the top.

Order of NAT rules 8.3:

Twice Nat

Auto Nat

After Auto Nat

Regards,

Remember to rate all the helpul posts