topic ASA transparent mode twice nat in Network Security

ASA transparent mode twice nat

ofir-nissim — Mon, 11 Mar 2019 22:06:32 GMT

HI all.

has anyone done this ?

i'm aware to the limitations :

•In transparent mode, you must specify the real and mapped interfaces; you cannot use any.

•In transparent mode, you cannot configure interface PAT, because the transparent mode interfaces do not have IP addresses. You also cannot use the management IP address as a mapped address.

the question is can it be done?

ASA transparent mode twice nat

andrey.dugin — Mon, 26 Dec 2011 10:11:57 GMT

Your task is not clear. May you explain what do you want to do?

ASA transparent mode twice nat

Julio Carvajal — Mon, 26 Dec 2011 18:00:11 GMT

Hello Ofir,

If your question is :

-Is Twice nat supported on transparent mode?

The answer is yes, it is supported, of course you will need to follow the limitations you have described to build the twice nat properly.

Regards,

Julio

ASA transparent mode twice nat

ofir-nissim — Mon, 26 Dec 2011 20:47:16 GMT

Hi all

thank you for your posts,

i need to perform bi-driectional nat (souce and destination) , will twice nat be usefull to me

or simple source and destination nat will be enough?

ASA transparent mode twice nat

Julio Carvajal — Mon, 26 Dec 2011 21:02:21 GMT

Hello Ofir,

Twice nat is the one you are looking for, that one will help you trying to set this nat rule up.

Please do rate helpful posts.

Regards,

Julio

ASA transparent mode twice nat

ofir-nissim — Mon, 26 Dec 2011 21:04:23 GMT

Hi Julio,

can you please post sample configuration for twice nat in TP mode?

TIA

ASA transparent mode twice nat

Julio Carvajal — Mon, 26 Dec 2011 21:12:08 GMT

Hello Ofir,

The configuration of the nat is the same one as on router mode

Lets say inside host 10.2.1.2 is going to be natted on the outside to 2.2.2.2 when it goes to 3.3.3.3

Here is the configuration to accomplish this

Object network inside-host

host 10.2.1.2

object network nat-ip

host 2.2.2.2

object network destination-outside

host 3.3.3.3

nat (inside,outside) source static inside-host nat-ip destination static destination-outside destination-outside

Hope this helps,

Julio!!

ASA transparent mode twice nat

ofir-nissim — Mon, 26 Dec 2011 21:14:25 GMT

Hi Julio,

and what about the other direction, can it be natted also?

ASA transparent mode twice nat

Julio Carvajal — Mon, 26 Dec 2011 21:22:40 GMT

Hello Ofir,

Yes, it can be done as well, the NAT feature will work the same way except for the limitations you have explained:

•In transparent mode, you must specify the real and mapped interfaces; you cannot use any.

•In transparent mode, you cannot configure interface PAT, because the transparent mode interfaces do not have IP addresses. You also cannot use the management IP address as a mapped address.

Regards,

Do please rate helpful post

Julio

ASA transparent mode twice nat

ofir-nissim — Mon, 26 Dec 2011 21:26:05 GMT

Hi Julio,

do i need to configure addional nat rule or the asa will maitain the nat state on both directions?

what if i would like to hide both sides of the asa using different segments, how will the configuration look like?

TIA

ASA transparent mode twice nat

Julio Carvajal — Mon, 26 Dec 2011 21:29:09 GMT

Hello Ofir,

Lets say inside host 10.2.1.2 is going to be natted on the outside to 2.2.2.2 when it goes to 3.3.3.3 witch in fact is 10.3.1.2, so you will hide both sides.

Here is the configuration to accomplish this

Object network inside-host

host 10.2.1.2

object network nat-ip

host 2.2.2.2

object network destination-outside

host 3.3.3.3

object network destination-host

host 10.3.1.2

nat (inside,outside) source static inside-host nat-ip destination static destination-outside destination-host

So when the inside user goes to 3.3.3.3 he will be natted to 2.2.2.2 and the destination as well be natted to 10.3.1.2.

Is this what you are asking for?

ASA transparent mode twice nat

ofir-nissim — Mon, 26 Dec 2011 21:32:30 GMT

Hi Julio,

is there a limitation when these the 10.2 and 10.3 networks are not directly connected to the asa?

is proxy nat needed for this kind of configuration?

ASA transparent mode twice nat

Julio Carvajal — Mon, 26 Dec 2011 21:45:51 GMT

Hello Ofir,

Not at all you can still do it, the ASA will proxy arp the global ip address for the inside user, in this example will proxy arp the 2.2.2.2..

Regards,

Julio

ASA transparent mode twice nat

ofir-nissim — Mon, 26 Dec 2011 21:51:26 GMT

Hi Julio,

i think i missed something..

using one nat rule , when 10.3 network will initiate traffic to 2.2.2.2 it will match this nat rule?

ASA transparent mode twice nat

Julio Carvajal — Mon, 26 Dec 2011 22:06:03 GMT

Hello Ofir,

Nope, when 10.3.1.2 the nat rule will take place as well.

Static is bi-derectional.

Regards,

Julio

ASA transparent mode twice nat

ofir-nissim — Mon, 26 Dec 2011 22:12:02 GMT

Hi Julio,

how will the acl look like' natted network to natted network?

is there any limitation with protocol inspection while using twice nat such as icmp?

ASA transparent mode twice nat

Julio Carvajal — Mon, 26 Dec 2011 22:36:52 GMT

Hello,

Lets start all over again.

Inside network user (192.168.10.2)------------ASA------Outside------------------(4.2.2.2)------------166.168.13.2(User)

And you want to nat the inside user to 3.3.3.3 when it goest to 4.2.2.2

You also want to nat the user 166.168.13.2 to 4.2.2.2 when it hits 3.3.3.3

So the nat would be

nat (inside,outside) source static 192.168.10.2 3.3.3.3 destination static 166.168.13.2 4.2.2.2

The ACL should be :

access-list out_in permit 4.2.2.2 any

access-group out_in in interface outside

Please rate helpful posts.

Julio

ASA transparent mode twice nat

ofir-nissim — Wed, 28 Dec 2011 06:46:47 GMT

HI Julio,

how the routing table on the ASA will look like - it's in TP mode

let say that the management ip of the asa is 5.5.5.5

ASA transparent mode twice nat

Julio Carvajal — Wed, 28 Dec 2011 17:36:56 GMT

Hello Ofir,

Well as you know on Transparent mode you only can have static routes so as an example here is the show route from one of the ASAs on my lab:

Show route

Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP

i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area

* - candidate default, U - per-user static route, o - ODR

P - periodic downloaded static route

Gateway of last resort is xxx.xxx.xxx.xx to network 0.0.0.0

S* 0.0.0.0 0.0.0.0 [1/0] via xx.xx.xx.xx, outside

Remember that the ASA uses both the Xlate table and the Routing table to route packets.

Regards,

Do please rate helpful posts.

Julio

ASA transparent mode twice nat

ofir-nissim — Sun, 01 Jan 2012 06:04:27 GMT

Julio,

Happy new year!

how can i translate all the inside lan to new lan :

Inside network LAN(192.168.10.0)------(3.3.3.0)------ASA------Outside------------------(4.2.2.0)------------166.168.13.0(LAN)

And you want to nat the inside user to 3.3.3.0 when it goest to 4.2.2.0

You also want to nat the user 166.168.13.0 to 4.2.2.0 when it hits 3.3.3.0

how the nat would be and the ACL ?