topic outside nat in asa in Network Security

outside nat in asa

diptanshusingh — Fri, 21 Feb 2020 09:39:07 GMT

Hi guys i am a bit confused, please help me ..

RTR2----(Outside)ASA(Inside)----Rtr1

the outside n/w range is 192.168.1.0/24 with Rtr2 having .2 and ASA having .1

the inside n/w range is 192.168.2.0 with asa having .1 and Rtr1 hving .2

now i want to perform dynamic outside nat for Rtr2.

nat (outside) 1 192.168.1.0 255.255.255.0

global (inside) 1 interface

nat (outside) 1 192.168.1.0 255.255.255.0 outside

global (inside) 1 interface

-------

i knw that outside keyword is used for outside nat , and when i try to configure

nat command on outside intf, it gives me a warning also..but it takes the command.

my doubt is why outside nat doesnt works with outside keyword.I hope you guys got my doubt..

Re: outside nat in asa

mattiaseriksson — Wed, 22 Aug 2007 11:56:29 GMT

You are correct, this is the correct way to do it.

nat (outside) 1 192.168.1.0 255.255.255.0 outside

global (inside) 1 interface

If it is not working, check the access-list applied to the outside interface, and show xlate to confirm if you have any other existing xlates.

Pleas post the complete sanitized config if this does not help.

Re: outside nat in asa

diptanshusingh — Wed, 22 Aug 2007 13:07:14 GMT

Hi thanks for you reply matti..actually what i wanted to know is that why is it so that why only when we apply "outside " keyword then only it works.. bcz with out that also when say

nat (outside) 1 192.168.1.0 255.255.255.0

it means nat for the source ip address 192.168.1.0/24 to a different ip address.

Re: outside nat in asa

mattiaseriksson — Wed, 22 Aug 2007 13:25:43 GMT

The outside keyword will allow the connections to initiate from an interface with a lower security level.

Re: outside nat in asa

diptanshusingh — Wed, 22 Aug 2007 13:29:32 GMT

ohh ..thanks...i got it...this means when i want to configure the same thing from my DMZ--to--inside.

then i have to apply

nat (dmz) 1 0 0 outside..

Re: outside nat in asa

mattiaseriksson — Wed, 22 Aug 2007 13:41:20 GMT

Correct.

The outside keyword represent any outer (less secure) interface, not the actual outside.

Re: outside nat in asa

diptanshusingh — Wed, 22 Aug 2007 13:43:00 GMT

thanks for clearing my concept...

Re: outside nat in asa

diptanshusingh — Wed, 22 Aug 2007 14:52:16 GMT

Hi matti . i have the following setup

host---(inside)Pix(Outside)---Rtr

host ip address 10.0.0.10

Pix Inside 10.0.0.1

Pix Outside 172.31.0.1

Rtr IP add:172.31.0.2(Rtr having a deault route to pix)

i tried to configure outside nat, but its not working.

hostname Firewall

enable password xxx encrypted

names

interface Ethernet0

speed 100

nameif outside

security-level 0

ip address 172.31.0.1 255.255.255.0

interface Ethernet1

speed 100

nameif inside

security-level 100

ip address 10.0.0.1 255.255.255.0

passwd xxx

ftp mode passive

access-list outside extended permit ip any any

pager lines 24

logging enable

icmp unreachable rate-limit 1 burst-size 1

nat-control

global (inside) 1 interface

nat (outside) 1 0.0.0.0 0.0.0.0 outside

nat (inside) 1 0.0.0.0 0.0.0.0

access-group outside in interface outside

telnet timeout 5

ssh timeout 5

console timeout 0

----

i see the following messages

%PIX-6-305011: Built dynamic ICMP translation from outside:172.31.0.2/2253 to in

side:10.0.0.1/30