topic ASA NAT based on source network in Network Security https://community.cisco.com/t5/network-security/asa-nat-based-on-source-network/m-p/1668021#M561230 <HTML><HEAD></HEAD><BODY><P>Sounds like what I am looking for. Can you point me in the right direction for examples or documentation?</P></BODY></HTML> Tue, 07 Jun 2011 08:33:49 GMT MICHAEL KENNEDY 2011-06-07T08:33:49Z ASA NAT based on source network https://community.cisco.com/t5/network-security/asa-nat-based-on-source-network/m-p/1668017#M561225 <P>I have a question regarding the merging of 2 networks and NAT. The networks and interface names have been changed to simplify the diagram below.</P><P></P><P>The 192.168.0.0 network has never used a NAT translation to connect to the server 1.1.1.1. The 172.17.0.0 network used to sit on another interface which required NAT and has been moved.</P><P></P><P>Can I create a NAT translation based on a network range? </P><P></P><P>I have resolved this issue by using a NAT exemption for the 192.168.0.0 network but I like the flexibility NAT based on the source network (Checkpoint NAT is configured in this way).</P><P></P><P>Thanks in advance</P><P></P><P><IMG src="https://community.cisco.com/legacyfs/online/legacy/9/1/5/48519-NAT-Based-On-Network.jpg" alt="NAT-Based-On-Network.jpg" class="jive-image-thumbnail jive-image" onclick="" width="450" /></P> Mon, 11 Mar 2019 20:42:31 GMT https://community.cisco.com/t5/network-security/asa-nat-based-on-source-network/m-p/1668017#M561225 MICHAEL KENNEDY 2019-03-11T20:42:31Z ASA NAT based on source network https://community.cisco.com/t5/network-security/asa-nat-based-on-source-network/m-p/1668018#M561226 <HTML><HEAD></HEAD><BODY><P>Which version of code on the ASA?</P><P></P><P>On which interface does 172.17.0.0/16 terminate?</P></BODY></HTML> Mon, 06 Jun 2011 15:18:16 GMT https://community.cisco.com/t5/network-security/asa-nat-based-on-source-network/m-p/1668018#M561226 f00f1ter 2011-06-06T15:18:16Z ASA NAT based on source network https://community.cisco.com/t5/network-security/asa-nat-based-on-source-network/m-p/1668019#M561228 <HTML><HEAD></HEAD><BODY><P> You can create a NAT entry for 1.1.1.1 and then restrict by access list to source network. That will NAT it for everything talking to it through the outside (of which ever interface 172.17.0.0 is plugged into) interface.</P></BODY></HTML> Mon, 06 Jun 2011 17:23:16 GMT https://community.cisco.com/t5/network-security/asa-nat-based-on-source-network/m-p/1668019#M561228 tarekaljallad 2011-06-06T17:23:16Z ASA NAT based on source network https://community.cisco.com/t5/network-security/asa-nat-based-on-source-network/m-p/1668020#M561229 <HTML><HEAD></HEAD><BODY><P> The code version is 8.05. 172.17.0.0/16 was an external network to a third party but has been brought onto the corporate network on the inside interface. The 192.168.0.0/24 was always a trusted network and didn't require NAT. The server sits on our DMZ. </P><P>If this was a new network connection we would not use NAT but there are so many applications from the 172.17/16 range using the NAT address that this is not viable.</P></BODY></HTML> Tue, 07 Jun 2011 08:28:41 GMT https://community.cisco.com/t5/network-security/asa-nat-based-on-source-network/m-p/1668020#M561229 MICHAEL KENNEDY 2011-06-07T08:28:41Z ASA NAT based on source network https://community.cisco.com/t5/network-security/asa-nat-based-on-source-network/m-p/1668021#M561230 <HTML><HEAD></HEAD><BODY><P>Sounds like what I am looking for. Can you point me in the right direction for examples or documentation?</P></BODY></HTML> Tue, 07 Jun 2011 08:33:49 GMT https://community.cisco.com/t5/network-security/asa-nat-based-on-source-network/m-p/1668021#M561230 MICHAEL KENNEDY 2011-06-07T08:33:49Z ASA NAT based on source network https://community.cisco.com/t5/network-security/asa-nat-based-on-source-network/m-p/1668022#M561231 <HTML><HEAD></HEAD><BODY><P> If the 172.17.0.0 is behind your inside interface, then you do not need NAT between it and 1.1.1.1 in your DMZ, simply make sure the ASA has the proper route to 172.17.0.0 in your internal network. </P><P></P><P>This might help:</P><P><A href="http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00807fc191.shtml">http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00807fc191.shtml</A></P></BODY></HTML> Tue, 07 Jun 2011 11:46:28 GMT https://community.cisco.com/t5/network-security/asa-nat-based-on-source-network/m-p/1668022#M561231 tarekaljallad 2011-06-07T11:46:28Z