topic ASA NAT in Network Security

ASA NAT

SathishkumarSaravanan0348 — Fri, 21 Feb 2020 17:33:32 GMT

Hello Experts,

Could you please explain which is the outside IP and which is the inside IP and which is the NAT ip?

1.nat (outside,inside) source static obj-10.140.4.10 obj-10.66.23.39 destination static obj-209.51.47.8 obj-209.51.51.136

2.nat (outside,inside) source static obj-10.140.4.11 obj-10.66.23.70

Regards

Sathish

Re: ASA NAT

Marius Gunnerud — Fri, 04 Oct 2019 09:39:00 GMT

1.nat (outside,inside) source static obj-10.140.4.10 obj-10.66.23.39 destination static obj-209.51.47.8 obj-209.51.51.136

nat (real_int,translated_int) source static real-object translated-object destination static translated-object real-object

2.nat (outside,inside) source static obj-10.140.4.11 obj-10.66.23.70

nat (real_int, translated_int) source static real-object translated-object

Re: ASA NAT

SathishkumarSaravanan0348 — Thu, 10 Oct 2019 10:11:06 GMT

Thanks for the answer. Could any experts please explain what is the use of this NAT and how it works in simple terms

Re: ASA NAT

Marius Gunnerud — Thu, 10 Oct 2019 10:47:33 GMT

nat (outside,inside) source static obj-10.140.4.10 obj-10.66.23.39 destination static obj-209.51.47.8 obj-209.51.51.136

This NAT can be configured in either section 1 (manual NAT) or section 3 (after-auto manual NAT), and it is matched in a top down fashion (so the order they appear in the configuration matters).

This format is basically a policy NAT with the ability to also translate the destination IP or subnet. So here you can specify that if traffic sourced from 10.140.4.10 has a destination of 209.51.47.8, change the source IP to 10.66.23.39 and change the destination IP to 209.51.51.136.

This NAT (twice NAT) has several use cases.

1. you need to NAT the source address to avoid IP conflict or you have a requirement that the source IP needs to be a specific IP that cannot be assigned to the PC for whatever reason.

2. This format is also used for NAT exempt for VPN configurations

3. You need to NAT the destination IP or subnet, this is usually done to either avoid IP conflict or you have a requirement that your PCs need to user a specific IP or subnet to reach a destination but the destination is not able to actually use this other IP.

nat (outside,inside) source static obj-10.140.4.11 obj-10.66.23.70

This NAT can be configured in either section 1 (manual NAT) or section 3 (after-auto manual NAT), and it is matched in a top down fashion (so the order they appear in the configuration matters).

This NAT has the same function as object NAT which is configured in section 2 (auto NAT). This type of NAT just translates the source IP or subnet.

Use cases:

1. Translate server source IP to a dedicated public IP, or private IP depending on what you are trying to achieve.

Re: ASA NAT

SathishkumarSaravanan0348 — Wed, 16 Oct 2019 14:08:58 GMT

Thanks a lot for the reply