topic Can you NAT a single internal IP to multiple public IPs? in Network Security

Can you NAT a single internal IP to multiple public IPs?

Xavier Lloyd — Mon, 11 Mar 2019 20:58:05 GMT

If I have 2 ISPs and a mail server somewhere behind the firewall, can I have 2 public addresses being NATed to a single private address (one for each ISP)?

Assuming that I'm using version 8.4, can the following work without the ASA complaining?

object network mail-server-out1

host 4.4.4.4

object network mail-server-out2

host 5.5.5.5

object network mail-server-in1

host 10.1.1.1

nat (inside,outside1) source static mail-server-in1 mail-server-in1 destination static mail-server-out1 mail-server-out1

object network mail-server-in2

host 10.2.2.2

nat (inside,outside2) source static mail-server-in2 mail-server-in2 destination static mail-server-out2 mail-server-out2

(not sure if the syntax is right...still getting used to the new NAT)

Questions? Thoughts? Ideas?

Thanks much!

Regards

Xavier

Can you NAT a single internal IP to multiple public IPs?

varrao — Wed, 13 Jul 2011 02:34:53 GMT

Hi Xavier,

That would not be possible, you would be able to access the server from outside but the return packet would not be able to know from whicj ip address it is supposed to nat, so my suggestion qwould be to use dual nic on your server machine, that would make things easdier for you.

Hope this helps

Thanks,

Varun

Can you NAT a single internal IP to multiple public IPs?

Parminder Sian — Wed, 13 Jul 2011 08:20:14 GMT

Hey Xavier,

You can try following :-

object network webServer --------------> Internal server IP

host 192.168.1.99

object network webServerGlobal1 ----------> Global IP

host 209.165.200.225

object network webServerGlobal2 -----------> Global IP

host 209.165.200.226

nat (inside,outside) source static webServer webServerGlobal1 unidirectional

nat (inside,outside) source static webServer webServerGlobal2

With this config, the first nat statement will work in one direction only not bidirectional as in earlier version. So to access the server from outside Second nat statement will work as it is bidirectional and first one wont come in action.

Give it a try and see how it goes.

I hope it works according to what you are palnning on achieving.

Parminder Sian

Can you NAT a single internal IP to multiple public IPs?

Xavier Lloyd — Wed, 13 Jul 2011 11:52:02 GMT

Hey Parminder,

I forgot about the unidirectional keyword! Thanks man. I don't think I'll be able to test it out 'cause I don't have access to an ASA with 8.4 but it looks like it can work.

I was actually hoping someone would be able to lab it up for me and tell me but I figured it would be a bit much to ask. I'm going to see if I can find a way to try it out a bit later though.

Thanks again!

Xavier

Can you NAT a single internal IP to multiple public IPs?

varrao — Sat, 16 Jul 2011 13:31:08 GMT

Hi Xavier,

Did a bit of research and yes we can make it possible, here is a sample configuration for it:

object network mail-server-out1

host 4.4.4.4

object network mail-server-out2

host 5.5.5.5

object network mail-server-in1

host 10.1.1.1

nat (outside1,inside) source static any interface destination static mail-server-out1 mail-server-in1

nat (outside2,inside) source static any interface destination static mail-server-out2 mail-server-in1

I had a simialr config requirement in one of the threads and it worked perfect.

May be you can use it.

Hope this helps,

Thanks,

Varun

Can you NAT a single internal IP to multiple public IPs?

Xavier Lloyd — Mon, 18 Jul 2011 13:52:13 GMT

Cool! I'll try to test it out when I get a chance.

Thanks much Varun!

Cheers

Xavier

Can you NAT a single internal IP to multiple public IPs?

varrao — Mon, 18 Jul 2011 14:03:34 GMT

Great!! Sure, do let me know the results...

-Varun