topic ASA NAT Question in Network Security

ASA NAT Question

cyoung1981 — Fri, 21 Feb 2020 16:47:48 GMT

I'm still figuring out NAT in the post 8.2 world. This question is a two parter. First. I have configured SSL VPN and and have the no nat setup like this.....

nat (inside,outside) source static INTERNAL INTERNAL destination static VPN VPN no-proxy-arp route-lookup

Since INTERNAL and VPN are object groups is static correct here? Or should it be dynamic?

Second part is along the same lines. I have other firewalls behind my ASA. For those networks I need to NAT the public IP's to themselves and let them pass to their destination firewall. I THINK I would configure it like this?

object network SUB1
 range 1.1.1.1 1.1.1.250
!
object network SUB2
 range 2.2.2.1 2.2.2.250
!
object-group network ONE-ONE
 network-object object SUB1
network-object object SUB2
!
nat (inside,outside) source static ONE-ONE destination static ONE-ONE

or would it be like the no nat for vpn and be like this?

nat (inside,outside) source static ONE-ONE ONE-ONE destination static ONE-ONE ONE-ONE

or am i over thinking this and it really just needs to be?

object-group network ONE-ONE
nat static ONE-ONE

Re: ASA NAT Question

Mohammed al Baqari — Mon, 11 Feb 2019 05:36:18 GMT

You first statement is correct and for 2nd use the same vpn nat

Re: ASA NAT Question

Marius Gunnerud — Mon, 11 Feb 2019 15:59:32 GMT

Your identity NAT statement (aka no NAT) is correct.

I am not sure I understand what you are trying to achieve here. Are these public IPs configured on the ASAs themselves and are just to be routed through this internet firewall?