topic Re: Double Nat Best Practice in Network Security https://community.cisco.com/t5/network-security/double-nat-best-practice/m-p/1255225#M839601 <HTML><HEAD></HEAD><BODY><P>Personally, I would NAT on the outside FW. Your decision should be base on your security policy. Are you allowed to route between the DMZ and the inside? If not, then option A above.</P></BODY></HTML> Tue, 30 Jun 2009 12:05:46 GMT Collin Clark 2009-06-30T12:05:46Z Double Nat Best Practice https://community.cisco.com/t5/network-security/double-nat-best-practice/m-p/1255224#M839595 <P>Hey pros!</P><P></P><P>i wanted to get your opinion on best practice scenario.</P><P></P><P>I want to Nat and Pat a server in our LAN to be accessible on the Internet.</P><P></P><P>configuration:</P><P>LAN |FW| DMZ |FW| Internet</P><P></P><P>now cos the server is in the lan and i want to NAT it for the internet. </P><P></P><P>Do i,</P><P>a) Nat it on the first inside FW to the DMZ then Nat it again on the 2nd outside FW?</P><P></P><P>b) Nat it on the inside FW to the Internet only?</P><P></P><P>c) Only Nat it on the outside FW to the Internet?</P><P></P><P>Note: our Public Addressing is viewable from DMZ also, hence why i have the option of Natting from either.</P><P></P><P>hope this makes sense</P> Mon, 11 Mar 2019 15:49:17 GMT https://community.cisco.com/t5/network-security/double-nat-best-practice/m-p/1255224#M839595 jtphilies 2019-03-11T15:49:17Z Re: Double Nat Best Practice https://community.cisco.com/t5/network-security/double-nat-best-practice/m-p/1255225#M839601 <HTML><HEAD></HEAD><BODY><P>Personally, I would NAT on the outside FW. Your decision should be base on your security policy. Are you allowed to route between the DMZ and the inside? If not, then option A above.</P></BODY></HTML> Tue, 30 Jun 2009 12:05:46 GMT https://community.cisco.com/t5/network-security/double-nat-best-practice/m-p/1255225#M839601 Collin Clark 2009-06-30T12:05:46Z