topic ASA NAT on outside interface - different subnet in Network Security

ASA NAT on outside interface - different subnet

sidcracker — Mon, 11 Mar 2019 20:54:41 GMT

Hello

Is it possible to configure a different subnet on the outside interface only for NAT

for example if the outside interface is 192.168.168.100.1, then can we have a subnet for doing static nats such as 192.168.101.1/28. Are there any additional statements we need to add to make this work?

Thanks

ASA NAT on outside interface - different subnet

sidcracker — Tue, 05 Jul 2011 06:11:57 GMT

This is running 8.3 code

ASA NAT on outside interface - different subnet

Jennifer Halim — Tue, 05 Jul 2011 06:17:51 GMT

Yes, you can. NAT doesn't need to be in the same subnet as the outside interface subnet. As long as, there is route on the next hop device to point 192.168.101.0/28 subnet towards the outside interface (192.168.100.1).

Also, you would need to ensure that proxy arp is enabled on outside interface. By default, it is enabled.

Command to enable proxy arp:

no sysopt noproxyarp outside

ASA NAT on outside interface - different subnet

sidcracker — Tue, 05 Jul 2011 06:23:44 GMT

Thanks again Jennifer