topic Re: server ip translation with asa in Network Security

server ip translation with asa

suthomas1 — Mon, 11 Mar 2019 19:10:32 GMT

One of the server host uses the same internet ip to get on to internet and also receive the request from internet to itself. this was done for address space restraint. But a recent security audit has forced to seperate the communication for this server using a single internet registered ip both ways.

i.e server host 10.19.2.2 will use internet IP X.X.X.X for internet bound data from itself & the same X.X.X.X internet IP will be used to reach this host when any other host on internet needs to start a new connection to 10.19.2.2.

Insights into how best,this can be achieved, will be helpful.

TIA.

Re: server ip translation with asa

Federico Coto Fajardo — Wed, 17 Nov 2010 14:07:53 GMT

Hi,

If you want to do this on ASA you can do the following:

static (in,out) tcp 2.2.2.2 80 1.1.1.1 80

nat (inside) 1 1.1.1.1 255.255.255.255

global (outside) 1 2.2.2.3

The above example assumes the following:

Inbound connections to the server (1.1.1.1) will use the NAT IP (2.2.2.2) when the requests comes on port 80.

Outbound traffic from the server will use (2.2.2.3) to get to the Internet.

Hope it helps.

Federico.

Re: server ip translation with asa

suthomas1 — Wed, 17 Nov 2010 14:24:32 GMT

Thanks. Apologize if my question was not clear.

Taking the eg. that you have stated, our policy needs me to use the same public IP for this server host 1.1.1.1 when going out to internet & use the same public IP for inbound connections to this server initiated by any source from the internet.

TIA.

Re: server ip translation with asa

Federico Coto Fajardo — Wed, 17 Nov 2010 14:26:25 GMT

In that case you can modify the configuration to this:

static (in,out) 2.2.2.2 1.1.1.1

The above command will always translate 1.1.1.1 to 2.2.2.2 for inbound or outbound trafffic.

Federico.

Re: server ip translation with asa

suthomas1 — Wed, 17 Nov 2010 14:35:50 GMT

so the static line will accomplish the task for both inbound & outbound using same ip.

and i would say there needs to be an acl on the outside interface for the incoming new request. would this static and rule hold true for both tcp & udp connections.

Appreciate your help. Thanks.

Re: server ip translation with asa

Federico Coto Fajardo — Wed, 17 Nov 2010 14:37:31 GMT

Correct.

The static will hold true for TCP and UDP connections.

Also, to allow incoming traffic you require the ACL as you mentioned.

Federico.

Re: server ip translation with asa

suthomas1 — Wed, 17 Nov 2010 14:47:15 GMT

Thanks, last query , to check these connections when in use , would sh conn and sh xlate be appropriate commands . Or any other command for this.

Re: server ip translation with asa

Federico Coto Fajardo — Wed, 17 Nov 2010 14:49:56 GMT

Correct.

To check the translations (layer 3) you use sh xlate

To check the connections (layer 4) you use sh conn (sh conn state/sh conn det)

Since you have a static one-to-one NAT, there's going to be a single XLATE with multiple connections for that particular host.

Federico.