topic Re: NAT config in Network Security

NAT config

oneirishpollack — Mon, 11 Mar 2019 16:33:57 GMT

My company has a /24 global address. The NAT/PAT was setup to translate approx. 60 addresses per subnet using NAT, and then â€œfailoverâ€ (is that the right terminology) to PAT. So we have something like what I have below:

Engineering (subnet 10.7.7.0) ---ïƒ (Global Pool 7) NAT 189.23.24.60 - 189.23.24.150, PAT 189.23.24.151

Marketing (subnet 10.7.8.0) -ïƒ (Global Pool 😎 NAT 189.23.24.152 - 189.23.24.225, PAT 189.23.24.226

Can you tell me how common of a configuration the one-to-one mapping with a PAT â€œfailoverâ€ or catchall is?

How about from the perspective of resource utilization on the ASA 5510. Is it more work for it to do PAT vs. NAT?

When the ASA looks at the global pool, does it always pull from the NAT before it used the PAT address? That would seem logical, but I wasn't sure if you added the PAT into the pool first, before the range, if it would disregard the range all together.

Re: NAT config

Collin Clark — Thu, 29 Oct 2009 14:50:26 GMT

Can you tell me how common of a configuration the one-to-one mapping with a PAT â€œfailoverâ€ or catchall is?

It's not common, but most firms don't have a /24 so just a PAT is more common.

How about from the perspective of resource utilization on the ASA 5510. Is it more work for it to do PAT vs. NAT?

Pretty much the same.

When the ASA looks at the global pool, does it always pull from the NAT before it used the PAT address?

Yes, it grabs a full NAT until they are all gone, then it uses the PAT address.

Hope it helps.

Re: NAT config

oneirishpollack — Thu, 29 Oct 2009 17:35:41 GMT

You are awesome.