topic Re: NAT in Network Security

NAT

oezkanuenlue — Mon, 11 Mar 2019 18:46:18 GMT

Hello I have a problem with NAT,

the original config works fine (two lines below)

nat (inside) 1 10.149.0.0 255.0.0.0

global (outside) 1 62.206.190.254

Additional I want to NAT the inbound traffic for a customer from outside 172.16.X.X to 10.149.241.20-10.149.241.254 but when I type in the two lines below,

I get an error message like no translations group found.

global (inside) 2 10.149.241.20-10.149.241.254 netmask 255.255.255.0
nat (outside) 2 172.16.0.0 255.255.0.0 outside

I have no idea what went wrong.

Many thanks for your help

Re: NAT

Ashley Georgeson — Tue, 28 Sep 2010 08:57:21 GMT

I think for your inbound traffic (outside to inside) you will require a static nat translation.

e.g.

static (outside,inside) 10.149.241.0 172.16.0.0 netmask 255.255.255.0 0 0

I don't think that specific example will work for you due to subnet mask mis-match, but the theory may be on the right lines.

Alternatively, I found a post discussing the method you were trying, also finding similar issues:

http://www.groupstudy.com/archives/security/200306/msg00000.html

It may be worth a read - especially the conduit permit ip command and debugging they are using to troubleshoot.

Regards, Ash.

Re: NAT

oezkanuenlue — Tue, 28 Sep 2010 09:14:37 GMT

Thank you for your help ,

but I want to NAT dynamic addresses, without using static.

Re: NAT

praprama — Tue, 28 Sep 2010 15:54:43 GMT

Hi,

Can you past the exact error message you are getting? Also, please try running a packet-tracer from the outside to the inside and send that output as well.

Thanks and Regards,

Prapanch