topic NAT Processing Query - PIX 6.3 in Network Security

NAT Processing Query - PIX 6.3

charles.coutts — Mon, 11 Mar 2019 21:06:26 GMT

Hi All,

I have a query regarding order of NAT processing with the following configuration (as an example):

nameif ethernet1 inside security100
nameif ethernet2 dmz1 security50

nat (inside) 0 0.0.0.0 0.0.0.0

static (inside,dmz1) 192.168.0.0 192.168.0.0 netmask 255.255.0.0

route dmz1 10.10.10.0 255.255.255.0 172.16.1.1

route inside 192.168.0.0 255.255.0.0 192.168.20.20

When I initiate traffic from DMZ1 toward a host on the 192.168.0.0/16 (inside) network, I receive a "No translation group found" error message.

I would have expected the static statement to be matched first, and thus allow this translation to be created?

What are your thoughts?

Thanks,

Charlie

NAT Processing Query - PIX 6.3

varrao — Mon, 01 Aug 2011 13:47:44 GMT

You would need this nat as well;

nat (dmz1) 1 0.0.0.0 0.0.0.0

global (inside) 1 interface

Thanks,

-Varun

NAT Processing Query - PIX 6.3

Jon Marshall — Mon, 01 Aug 2011 13:57:37 GMT

Varun

Can you just explain why you need that. I ask because if you present addresses to the internet then you do not need to NAT the internet source IPs as they go through the firewall so why do you need the dmz addresses as they go to the inside ?

I may just be a bit of brainlock about this and be missing the obvious

Jon

NAT Processing Query - PIX 6.3

Jon Marshall — Mon, 01 Aug 2011 17:54:15 GMT

Varun

Is this because you assume there is no default-route within the LAN ie. if the network being accessed on the LAN is not directly connected to the ASA and there is no default-route then traffic would not get back to the ASA from the LAN ?

Jon

NAT Processing Query - PIX 6.3

charles.coutts — Mon, 15 Aug 2011 09:30:08 GMT

Hi Varun,

Are you able to answer the follow-up questions?

I agree with Jon's comments, and so am still unclear as to why the config I have is not sufficient.

Many thanks,

Charlie

NAT Processing Query - PIX 6.3

varrao — Mon, 15 Aug 2011 17:55:14 GMT

Hi Charles,

Yes, I agree with Jon's statement, if the destination network is not in the same network as the ASA, it is good to pat the traffic coming from the dmz to inside. It is not always necessary to create a translation for the source as well, going from lower security to higher security level, but it is just been added as a test to check whether the inside host respond to the firewall inside ip address.

-Varun