topic Re: ASA nat rules in Network Security

ASA nat rules

Spinu Viorel — Fri, 21 Feb 2020 11:47:58 GMT

Hello,

An ASA with inside, outside, DMZ1 and DMZ2 interfaces.(only DMZ are important here)

- DMZ1 have 172.16.1.0/24 , security-level 40

- DMZ2 have 172.20.3.0/24 , security-level 75 and a web server at 172.20.3.8

If I want to let the users from DMZ1 to access the web server from DMZ2, do I need a NAT with real addresses 172.16.1.0/24 and translated addresses 172.20.3.0/24 ?

thank u!

Re: ASA nat rules

Collin Clark — Mon, 16 Nov 2009 14:33:53 GMT

You can NAT with the real addresses. Here's an example-

static (dmz,dmz2) 172.20.3.0 172.20.3.0 netmask 255.255.255.0

Hope that helps.

Re: ASA nat rules

Spinu Viorel — Mon, 16 Nov 2009 14:57:25 GMT

is this absolutely necesary to NAT ?

If I don't configure NAT, I will not be able to access the web server ?

Re: ASA nat rules

Collin Clark — Mon, 16 Nov 2009 15:02:09 GMT

NAT is necessary because you're going from a lower security level interface to a higher one. If you don't configure NAT, you will have no connections and you will receive some logs that state "no translation group found".

Re: ASA nat rules

Panos Kampanakis — Mon, 16 Nov 2009 19:04:13 GMT

The only case where you could do away with no nat is if you enable "no nat-conrtrol" and the ASA has routes to the ip addresses and the ACL on the outside interface is open.

Re: ASA nat rules

Spinu Viorel — Tue, 17 Nov 2009 09:17:48 GMT

I am sorry to ask again. But it is not clear to me 🙂

I know that if you are going from a lower security level to a higher security level , u need an access-list that explicitly permit that traffic and not a NAT translation. So my question is: U need both an access-list and a NAT ?

Re: ASA nat rules

Collin Clark — Tue, 17 Nov 2009 14:16:21 GMT

Yes.