topic NAT Complications in Network Security

NAT Complications

andrewburridge — Mon, 11 Mar 2019 21:05:00 GMT

Hi Guys, was hoping you could help. I'm getting myself in a big muddle with regards to NATing, and could do with some clarity.

We have a setup whereby there are 2 firewalls back to back on a 172.22.11.0/24 subnet. I control one firewall, another company (company B) the other. My PIX has its outside interface as 172.22.11.254, and its inside interface as 172.22.255.21.

I'm trying to set up a NAT whereby clients on my inside network can connect to 172.22.11.11 (as this is routable by me) on a specific port, and this will NAT them to the real address 172.31.36.6 on the same port, on the other side of company B's firewall. Company B are doing the reverse.

I've allowed traffic to come into the firewall's inside interface, and can see it entering. There is a dynamic NAT mapping any traffic from the inside interface to the outside.

I've set up a static NAT policy rule on the outside interface, taking a source IP of the outside interface (172.22.11.254), a destination of 172.22.11.11, a static translation to 172.31.36.6, and the relevant port translation, but this doesn't work. Looking at the logs, I can't see anything even attempting to be translated.

I know this is a lot to take in, but any ideas where I'm going wrong?

Thanks for any suggestions.

NAT Complications

Jon Marshall — Thu, 28 Jul 2011 12:07:51 GMT

Andrew

I've set up a static NAT policy rule on the outside interface, taking a source IP of the outside interface (172.22.11.254), a destination of 172.22.11.11, a static translation to 172.31.36.6, and the relevant port translation, but this doesn't work. Looking at the logs, I can't see anything even attempting to be translated.

I'm not sure what you mean by the bit in bold. But from your requirements have you tried -

static (outside,inside) 172.22.11.11 172.31.36.6 netmask 255.255.255.255

Jon

NAT Complications

andrewburridge — Thu, 28 Jul 2011 13:33:56 GMT

Hi Jon,

That appears to be working now, at least from my end. I was going through the GUI and ended up applying the NAT the wrong way round by the looks of things. Lesson learned, alway stick to the CLI!

Thanks,

Andy

NAT Complications

Jon Marshall — Thu, 28 Jul 2011 13:39:48 GMT

Andy

Couldn't agree more. GUIs are useful sometimes but i never got on with ASDM at all. I would fire it up and by the time i had worked out what to do i could have configured 3 firewalls by using the CLI

Jon