topic Re: nat configuration in Network Security

nat configuration

suthomas1 — Mon, 11 Mar 2019 18:11:36 GMT

My ASA has an existing overloaded nat in place for all the connections going out.
like nat ( inside ) 1 0.0.0.0 0.0.0.0
i need to configure a seperate nat for outgoing translation with a set of ip's.
local ip's are 192.168.100.1 to 192.168.100.3 & it is to be natted with 202.88.116.27. Please help on how to configure this for use by these ip's only.

thanks in advance.

Re: nat configuration

Nagaraja Thanthry — Wed, 14 Jul 2010 00:50:59 GMT

Hello,

You can specify another NAT pool and specify specific source addresses that will be using that pool. In dynamic NAT, the firewall uses specific translation first before using the generic pool.

Global (outside) 2 202.88.116.27

Nat (inside) 2 192.168.100.0 255.255.255.252

Above configuration enables all the hosts between 192.168.100.0 to 100.3 to use the 202.88.116.27 address (since 100.0 is the network address, you will not see any traffic from that address).

Hope this helps.

Regards,

Re: nat configuration

suthomas1 — Wed, 14 Jul 2010 01:06:22 GMT

thanks for your reply. wouldnt i need to deny this pool being used by other internal ip's for nat.

Re: nat configuration

Nagaraja Thanthry — Wed, 14 Jul 2010 01:13:58 GMT

Hello,

Once the firewall picks one pool, it will not look for the second pool. The firewall always picks the longest (best) match for every source address (sometimes it will also check the destination address if you have configured policy nat). So, you do not need to explicitly deny an address from using a pool.

Hope this helps.

Regards,

Re: nat configuration

suthomas1 — Wed, 14 Jul 2010 02:30:32 GMT

ok, my intention is to ensure that this second global IP is not being used by other ip's except for 192.168.100.1 to 192.168.100.3.

nat ( inside ) 1 0.0.0.0 0.0.0.0 - this nat is using another global ip address for general overload. I want to ensure ip's from this range doesnt try to use

the second global ip for nat.

Would it be possible without any additional config.

Thanks in advance.

Re: nat configuration

Nagaraja Thanthry — Wed, 14 Jul 2010 02:40:28 GMT

Hello,

If you configure "nat (inside) 2 192.168.100.0 255.255.255.252" only addresses covered in the range can use the nat pool identified by number 2. You do not need any other configuration to block other IP addresses from using the range.

Hope this helps.

Regards,