topic Re: Policy NAT in Network Security

Policy NAT

Bruce Summers — Mon, 11 Mar 2019 19:46:43 GMT

Hi,

I need a little assistance here...I'm trying to do multiple nats...The intent is to nat traffic inbound to isolated/non-routable vlans to the vlan interface to give the appearance the traffic is within the same subnet to keep a couple hundred servers from having to have static routes placed on them....

I presently do this with traffic from vlan 701 and 702 to vlan 760 and 770...

However, I have a further requirement to nat a single address coming out of vlan 760 to the vlan interface for vlan 770. but, i have not been able to get this to function...and i'm not entirely sure that i can get it to work...below is the configs/info i'm working with...I removed the configs i have tried to use...

Goal: nat a single address, to the inteface of vlan 770 interface ONLY when traffic is destined for vlan 770 without breaking any of the other natting.

nat (Out_of_Band_Server_Mgmt) 1 access-list inside
nat (EBM_SVCS_2) 1 access-list PNAT702

global (Enterprise_Backup_and_Mgmt) 1 interface
global (Enterprise_Backup_and_Mgmt_2) 1 interface

access-list PNAT702 extended permit ip 10.76.169.0 255.255.255.0 192.168.213.0 255.255.255.0
access-list PNAT702 extended permit icmp 10.76.169.0 255.255.255.0 192.168.213.0 255.255.255.0

access-list inside extended permit icmp any any
access-list inside extended permit ip any any

interface Vlan701 10.76.168.1
nameif Out_of_Band_Server_Mgmt

interface Vlan702 10.76.169.1
nameif EBM_SVCS_2

interface Vlan760 192.168.212.1
nameif Enterprise_Backup_and_Mgmt

interface Vlan770 192.168.213.1
nameif Enterprise_Backup_and_Mgmt_2
.

Re: Policy NAT

Jennifer Halim — Tue, 08 Feb 2011 11:55:13 GMT

Security level will be the important information that is required to further see how NATing can be done.

Also, can you please share all the current NAT, Global and Static NAT statements with all the corresponding access-list so we can see if there is any overlapping.

Re: Policy NAT

Praveena Shanubhogue — Tue, 08 Feb 2011 12:01:33 GMT

Hi Bruce,

However, I have a further requirement to nat a single address coming out of vlan 760 to the vlan interface for vlan 770.

Goal: nat a single address, to the inteface of vlan 770 interface ONLY when traffic is destined for vlan 770 without breaking any of the other natting.

Are you saying that you want to NAT traffic going from Vlan 760 destined to one of the ip addresses in vlan 770, and the translated ip address should be Vlan 770's interface ip address?

Please elaborate

Regards,

Praveev

Re: Policy NAT

Bruce Summers — Tue, 08 Feb 2011 12:10:20 GMT

Thanks Jennifer,

All nat and acl info is in my post...there's no other in relation to this natting

interface Vlan701

security-level 25

interface Vlan702

security-level 26

interface Vlan760

security-level 20

interface Vlan770

security-level 21

Bruce

Re: Policy NAT

Bruce Summers — Tue, 08 Feb 2011 12:13:20 GMT

Thanks for the response Praveev,

almost.

I want to nat a single address in vlan 760 to the interface of vlan 770 when traffic is sourced from 760 destined for 770...the intent is to make the 760 traffic appear as though it is in 770's subnet to keep from having to put static routes on the servers (100's of them)...

Bruce

Re: Policy NAT

Jennifer Halim — Tue, 08 Feb 2011 12:54:34 GMT

OK, so traffic is sourced from low security level (20) to high security level (21). You can't just configure dynamic NAT for that.

Here is the configuration that you will need:

static (Enterprise_Backup_and_Mgmt_2,Enterprise_Backup_and_Mgmt) 192.168.213.0 192.168.213.0 netmask 255.255.255.0

access-list Enterprise_Backup_and_Mgmt-NAT permit ip 192.168.212.0 255.255.255.0 192.168.213.0 255.255.255.0

nat (Enterprise_Backup_and_Mgmt) 1 access-list Enterprise_Backup_and_Mgmt-NAT outside

Then "clear xlate" after the above.

Re: Policy NAT

Jennifer Halim — Tue, 08 Feb 2011 22:57:37 GMT

How did it go? Does it work?

If it does, please kindly mark the post as answered and rate useful posts. Otherwise, pls provide more information on the failure and we can assist further.

Re: Policy NAT

Bruce Summers — Tue, 08 Feb 2011 23:07:56 GMT

I'm afraid I didn't get a chance to implement/test today...to many fires..

I have a question, are u a tac engineer? I recognize ur name for some reason.

Re: Policy NAT

Jennifer Halim — Tue, 08 Feb 2011 23:13:55 GMT

Good memory, I used to be in the TAC

Re: Policy NAT

Bruce Summers — Tue, 08 Feb 2011 23:18:55 GMT

Lol...you have helped me many time. Not with tac any more?

When I get this implemented, ill holler and let ya know..

Re: Policy NAT

Bruce Summers — Wed, 09 Feb 2011 00:16:56 GMT

Can I pose a separate question concerning running a dhcp service on ur firewall

Re: Policy NAT

Jennifer Halim — Wed, 09 Feb 2011 00:18:07 GMT

Sure, go ahead.

Re: Policy NAT

Bruce Summers — Wed, 09 Feb 2011 00:24:56 GMT

Is running dhcp services for clients very resource intensive? We had a big discussion about whether we should or shouldn't. But in the end it boils down to is there any "technical" reason we shouldn't.

I think no, unless it overly tasks the firewall to do so.

Re: Policy NAT

Jennifer Halim — Wed, 09 Feb 2011 00:44:51 GMT

You are right, running DHCP services wouldn't be resource intensive. How big is the user base and which model of ASA are you running?

Re: Policy NAT

Bruce Summers — Wed, 09 Feb 2011 00:48:56 GMT

It's actually a FWSM...In this case, we're issuing out, in 3 subnets,

about 150 addresses...

bruce

Re: Policy NAT

Jennifer Halim — Wed, 09 Feb 2011 01:02:21 GMT

I wouldn't think there will be any problem with running DHCP server on FWSM especially just with 150 addresses.

I saw more problem with DHCP relay feature on FWSM.

Here is more information on DHCP server on FWSM for your reference:

http://www.cisco.com/en/US/docs/security/fwsm/fwsm32/configuration/guide/ip_f.html#wp1041659

Re: Policy NAT

Bruce Summers — Wed, 09 Feb 2011 01:05:57 GMT

Good deal...

I'll use the argument that "cisco tac" says go for it...lol...

Re: Policy NAT

Jennifer Halim — Wed, 09 Feb 2011 01:07:43 GMT

Ooops

Ex TAC you mean

Re: Policy NAT

Bruce Summers — Wed, 09 Feb 2011 01:09:55 GMT

I knew what I meant

They wont know...lol...

Thanks again, and when I blow that config onto that firewall, I'll post

the results and award some points...

Thanks

Re: Policy NAT

Bruce Summers — Wed, 09 Feb 2011 01:12:56 GMT

alright

one more question, if you don't mind...just advise more than anything...