topic Re: Reg: Nat using Statics in Network Security

Reg: Nat using Statics

kuldeep.kaur — Mon, 11 Mar 2019 20:33:40 GMT

Hi Guys,

I would like to nat using the static command and I would like to nat 10.180.1.0/24. Will the command syntax will be look like this

static (inside,testdmz) 10.180.1.0 10.180.1.0 netmask 255.255.255.0

Is the above correct ?

Tks

Re: Reg: Nat using Statics

varrao — Mon, 16 May 2011 03:44:27 GMT

Hi Kuldeep,

Yes the Nat is correct, if you are trying to nat the host in the network to their own IP's. This is called self-nat.

Thanks,

Varun

Re: Reg: Nat using Statics

Parminder Sian — Mon, 16 May 2011 09:00:32 GMT

Hi,

Please have a look at these two doc, might be helpful:-

PIX/ASA 7.x and FWSM: NAT and PAT Statements

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a008046f31a.shtml

PIX/ASA 7.x : Port Redirection(Forwarding) with nat, global, static and access-list Commands

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a00804708b4.shtml

Regards,

Parminder Sian

Re: Reg: Nat using Statics

kuldeep.kaur — Tue, 17 May 2011 04:02:24 GMT

Hi Guys,

Thanks for the help. I am still a bit confused. Yes I am trying to do self-nat. What I am trying to do (not sure whether possible or not) is:

Say i have ten host on inside from 192.168.1.1 - 192.168.1.10 and they need access to DMZ which also has couple of hosts. Can I do self nat with just one entry

static (inside,test_DMZ) 192.168.1.0 192.168.1.0 mask 255.255.255.0.

With the above statement thw whole subnet range 192.168.1.0/24 is self natted. Am i right ?

Also what is the first ip in the above line means 192.168.1.0 (one host or whole subnet or starting range).

Thank you very much guys.

Re: Reg: Nat using Statics

Maykol Rojas — Tue, 17 May 2011 04:20:00 GMT

Kuldeep,

Is actually the netmask which tells you if you are translating one host or an entire network:

static (inside,test_DMZ) 192.168.1.0 192.168.1.0 mask 255.255.255.0.

That would translate the subnet

static (inside,test_DMZ) 192.168.1.10 192.168.1.10 mask 255.255.255.255

That would self translate just the host .10, look at the mask.

Also, something to take in consideration, you will need to take the one that covers the subnet if you already added it, so the single self translation ones take effect.

Hope this helps.

Mike