topic Re: NAC Questions in Network Security

NAC Questions

talha_490 — Fri, 21 Feb 2020 11:44:51 GMT

We have 2 CAS should be configured with HA are located in the WAN Zone of the FWSM. there is a static NAT means

static (inside,WAN) 10.0.0.1 10.0.0.1 netmask 255.255.255.255

where 10.0.0.1 is the ip of CAM and the cas has 20.0.0.1.

I have read that if the CAS and CAM sare across the firewall then CAM will not add CAS as HA unit. The above natting is above.

Re: NAC Questions

Faisal Sehbai — Wed, 21 Oct 2009 13:27:54 GMT

Talha,

That is correct. HA with NAT'd CASs isn't supported.

HTH,

Faisal

Re: NAC Questions

talha_490 — Wed, 21 Oct 2009 14:23:02 GMT

Thanks Faisal,

So should i conclude that in my scenario it is not possible for me to configure CAS in HA.

Re: NAC Questions

Faisal Sehbai — Wed, 21 Oct 2009 14:26:08 GMT

If there's NAT in the picture, then yes, this won't work. If you can somehow remove the NAT and route between the CAS and CAM, then it should be fine.

[Edit] I just looked at the NAT closely and apologize for giving you the wrong information. The only scenario when NAT breaks things is when the IP addresses are different when you're NAT'ing (e.g. 10.x being nat'ed to 192.168.x when reaching the CAM etc)

In this scenario where the NAT and the actual IP are the same it should work. You'll just have to ensure that the required traffic flow is open between the devices.

HTH,

Faisal

Re: NAC Questions

talha_490 — Wed, 21 Oct 2009 14:30:46 GMT

Dear Faisal,

The natting is a must as both the interfaces are of different security levels with inside and WAN as 100 and 70 respectively.

But why i am asking is because the nat command is not changing the ip address in my case as the translated ip is the same as the original ip.

static (inside,WAN) 10.0.0.1 10.0.0.1

but i have read the Doc as it talks about translated and original ip in general and there is no general details.