topic Re: multiple hosts in policy nat in Network Security

multiple hosts in policy nat

RvanRouwendaal — Mon, 11 Mar 2019 18:23:32 GMT

how can i do this:

access-list AL200 permit ip host 172.16.11.27 Units 255.255.192.0
access-list AL200 permit ip host 172.16.11.27 Routers 255.255.255.248
access-list AL200 permit ip host 172.16.11.27 host IMSA
access-list AL200 permit ip host 172.16.11.27 host EIserver

access-list AL200 permit ip host 172.16.11.26 host GGSNnew
access-list AL200 permit ip host 172.16.11.26 Meterpool 255.255.240.0

static (production,outside) 172.16.11.200 access-list AL200 0 0

Re: multiple hosts in policy nat

RvanRouwendaal — Tue, 10 Aug 2010 20:16:33 GMT

Forgot to mention that i need to do this on a Cisco PIX 506e

Re: multiple hosts in policy nat

Andrew Ossipov — Tue, 10 Aug 2010 20:52:23 GMT

Hello Rick,

Since static NAT creates one-to-one mappings by definition, you cannot translate the traffic from two hosts to the same IP. You need to either provision several mapped addresses for the static mapping or use dynamic policy NAT instead:

http://www.cisco.com/en/US/docs/security/pix/pix63/command/reference/mr.html#wp1032129

Andrew

Re: multiple hosts in policy nat

RvanRouwendaal — Tue, 10 Aug 2010 20:54:28 GMT

So what i am trying to do is not possible?

Re: multiple hosts in policy nat

RvanRouwendaal — Tue, 10 Aug 2010 20:55:56 GMT

so what you are trying to say it is not possible at all? i dont understand could you give me some directions?

Re: multiple hosts in policy nat

Andrew Ossipov — Tue, 10 Aug 2010 20:59:12 GMT

You can policy PAT traffic from just two hosts to the given IP address (this will only work outbound), but you cannot do it with the configuration above. The policy PAT would look somewhat like this:

nat (production) 11 access-list AL200

global (outside) 11 172.16.11.200

Andrew

Re: multiple hosts in policy nat

RvanRouwendaal — Tue, 10 Aug 2010 21:05:53 GMT

thank you so much this worked as a charm.

What kind off problems could this give?

Re: multiple hosts in policy nat

Andrew Ossipov — Tue, 10 Aug 2010 21:10:01 GMT

Glad it helped! It is a fairly standard NAT configuration, so it should work without problems. The only caveat is that you cannot initiate reverse connections from outside between the hosts and subnets identified in the ACL.

Andrew

Re: multiple hosts in policy nat

Kureli Sankar — Tue, 10 Aug 2010 21:13:25 GMT

You are unable to do this in PIX506 - 6.x code?

-KS

Re: multiple hosts in policy nat

RvanRouwendaal — Tue, 10 Aug 2010 21:17:38 GMT

I dont really understand your last post. Does this mean no traffic could come in on 172.16.11.200?

Re: multiple hosts in policy nat

Andrew Ossipov — Tue, 10 Aug 2010 21:19:49 GMT

That is correct, you cannot initiate inbound connections to 172.16.11.200. This is the main property of dynamic PAT. In order to initiate inbound connections, you must have one-to-one mapping with either one IP per inside host or one port per inside service (static PAT).

Andrew

Re: multiple hosts in policy nat

RvanRouwendaal — Tue, 10 Aug 2010 21:23:54 GMT

hmmmm thats gonna be a problem cause these rules initiate from both sides:

access-list AL200 permit ip host 172.16.11.26 host TMGGSNnew
access-list AL200 permit ip host 172.16.11.26 TMmeterpool 255.255.240.0

i there a work-around for this?

Re: multiple hosts in policy nat

Andrew Ossipov — Tue, 10 Aug 2010 21:26:10 GMT

The workaround is to dedicate one mapped (public) IP to each inside (private) host. I.e.:

access-list AL201 permit ip host 172.16.11.26 host GGSNnew
access-list AL201 permit ip host 172.16.11.26 Meterpool 255.255.240.0

static (production,outside) 172.16.11.200 access-list AL200

static (production,outside) 172.16.11.201 access-list AL201

Re: multiple hosts in policy nat

RvanRouwendaal — Tue, 10 Aug 2010 21:29:26 GMT

172.16.11.201 doesnt have access to the VPNs... so thats a no go...

The problem is that on the old server we had 2 environments which went to 3 VPNS... all using the 200 NAT. Now we made two new server (1 goes to 2 vpns and 1 goes to the third). They still need to do so with the 200 NAT