topic NAT quistion in Network Security

NAT quistion

rexpetersen — Mon, 11 Mar 2019 22:42:24 GMT

Hope someone can help me with the following problem.

I have an ASA 5510 that looks like this:

INTERFACE 0: DHCP (OUTSIDE)

INTERFACE 1: 10.45.0.1 255.255.255.0

INTERFACE 2: 192.168.0.1 255.255.255.0

I need to access the net (10.45.0.0 255.255.255.0) on INTERFACE 1 from all IP addresses (192.168.0.1 255.255.255.0) on INTERFACE 2

But all INTERFACE 2 addresses shall be translated to one single address (10.45.0.15) at INTERFACE 1

How can I do that ?

Thanks

Rex

NAT quistion

rizwanr74 — Thu, 15 Mar 2012 13:39:14 GMT

What version of your ASA ?

NAT quistion

rexpetersen — Thu, 15 Mar 2012 14:44:15 GMT

8.03

NAT quistion

rizwanr74 — Thu, 15 Mar 2012 15:00:58 GMT

I am not so sure of your interface names on your FW.

but I could assume as follows, in case they are not setup on your FW, please change those are in brakets (i.e. interface names) to reflect your ASA interface names.

static (inside,dmz) 10.0.0.0 10.0.0.0 netmask 255.0.0.0

INTERFACE 2: assumed security level less than 100.

INTERFACE 1: assumed security level equal to 100.

I hope this helps.

Thanks

Rizwan Rafeek.

NAT quistion

rexpetersen — Fri, 16 Mar 2012 09:00:43 GMT

rizwanr74

The way you suggest nat 1 to 1 a.a.a.1 vil translatet to b.b.b.1 , a.a.a.2 translatet to b.b.b.2

The way I wan is that entire a.a.a.a network wil be translatet to one single b.b.b.b address. Like PAT.

Best regards

Rex

NAT quistion

rizwanr74 — Fri, 16 Mar 2012 12:58:22 GMT

dmz = INTERFACE 1:

inside = INTERFACE 2:

access−list policy−nat extended permit ip 192.168.0.0 255.255.255.0 10.45.0.0 255.255.255.0

global (dmz) 45 10.45.0.15
nat (inside) 45 access-list policy−nat

Let me know, if this helps.

thanks

NAT quistion

rexpetersen — Mon, 19 Mar 2012 08:27:23 GMT

Back on work after a great weekend 🙂

OK i get the idea to make a virtual interface.

I have now implementet it, but somehow I can't get the access-list triggered ??

Even if it try for at short test to put in: ANY ANY ... nothing triggers the access-list.

Best regards

Rex

NAT quistion

alalli — Mon, 19 Mar 2012 10:39:40 GMT

Hi Rex,

I think that the access-list for nat is too restrictive....

try

access−list policy−nat extended permit ip 192.168.0.0 255.255.255.0 any

Regards

Amanda

NAT quistion

rexpetersen — Mon, 19 Mar 2012 11:48:58 GMT

Hi Amanda

Same problem ... no hits on the access-list.

Here my setup:

interface Ethernet0/0
nameif OUTSIDE
security-level 0
ip address x.x.x.154 255.255.255.240

interface Ethernet0/1.40
vlan 123
nameif KUNDENET
security-level 60

ip address 192.168.123.1 255.255.255.0

interface Ethernet0/1.60
vlan 130
nameif SAS_LAN_10
security-level 55
ip address 10.45.0.1 255.255.248.0

access-list policy-nat extended permit ip 10.45.0.0 255.255.248.0 192.168.123.0 255.255.255.0

global (KUNDENET) 45 192.168.123.121
nat (SAS_LAN_10) 45 access-list policy-nat

global (OUTSIDE) 1 interface
global (KUNDENET) 45 192.168.123.121

nat (SAS_LAN_10) 0 access-list NO_NAT
nat (SAS_LAN_10) 45 access-list policy-nat
nat (SAS_LAN_10) 1 10.45.0.0 255.255.248.0

nat (KUNDENET) 0 access-list NO_NAT
nat (KUNDENET) 1 192.168.123.0 255.255.255.0

The NO_NAT's are for some VPN tunnels

// Rex

NAT quistion

rizwanr74 — Mon, 19 Mar 2012 19:27:51 GMT

You need an ACL permit entry to enter high security(KUNDENET) zone interface from lower security (SAS_LAN_10)

zone interface.

access−list kundenet-in extended permit ip 10.45.0.0 255.255.248.0 192.168.123.0 255.255.255.0

access-group kundenet-in in interface KUNDENET

let me know, if that helps.

thanks

Rizwan Rafeek

NAT quistion

alalli — Tue, 20 Mar 2012 10:18:30 GMT

Hi Rex

Try a couple of things for me please.

Use the show nat command to see what NAT will be applied to the various interfaces and try setting the SAS_LAN_10 interface security level to 60.

Use the same-security-traffic permit inter-interface command.

The nat works by letting traffic from a protected interface go to a less protected or same level interface (with the command above).

Thanks very much

Regards,

Amanda Lalli-Cafini