topic Re: ASA NAT Exemption in Network Security

ASA NAT Exemption

Gordon Ross — Mon, 11 Mar 2019 21:14:17 GMT

I'm running ASA software 8.4(2)

I've setup the anyconnect VPN system, and it works fine. However, it's NATing to the inside interface of the ASA. How do I do the NAT exclude ?

The docs say you *used* to do:

access-list no_nat permit ip 192.168.0.0 255.255.255.0 any

nat (inside) 0 access-list no_nat

However, with the latest software, this isn't valid any more.
I tried:

object network SSLVPN
  subnet 192.168.0.0 255.255.255.0
nat (inside,any) source static SSLVPN SSLVPN no-proxy-arp

But my packets are still getting NATed.

Suggestions, please ?

Thanks,

GTG

Re: ASA NAT Exemption

varrao — Fri, 19 Aug 2011 13:04:34 GMT

Hi Gordon,

You might wanna try this:

Lets you had the following nat statement in the previous code:

access-list SSLVPN permit ip 10.0.0.0 255.0.0.0 20.0.0. 255.0.0.0

nat (inside) 0 access-list SSLVPN

The new NAT would be:

object network internal_subnet

subnet 10.0.0.0 255.0.0.0

object network remote_network

subnet 20.0.0.0 255.0.0.0

nat (inside,outside) source static internal_subnet internal_subnet destination static remote_network remote_network

Hope this helps.

Thanks,

Varun

Re: ASA NAT Exemption

varrao — Fri, 19 Aug 2011 13:05:31 GMT

Here's a doc as well, PFA

-Varun

Please rate helpful posts.

ASA NAT Exemption

Gordon Ross — Fri, 19 Aug 2011 13:10:10 GMT

object network internal_subnet  subnet 10.0.0.0 255.0.0.0
object network remote_network
  subnet 20.0.0.0 255.0.0.0
nat (inside,outside) source static internal_subnet internal_subnet destination static remote_network remote_network

So is the remote_subnet the ip pool subnet that the VPN clients are assigned by the ASA, and the internal_subnet the subnet the VPN clients want to access ?

GTG

ASA NAT Exemption

varrao — Fri, 19 Aug 2011 13:15:25 GMT

Yes, absolutely, if you are doing remote access vpn.

Thanks,

Varun