topic Re: How to do souce address NAT in Network Security

How to do souce address NAT

cisco_lite — Mon, 11 Mar 2019 14:46:11 GMT

hi,

Could you please let me know how to do source address NAT'ing on FWSM.

Source IP: 1.1.1.1

Ingress interface: DMZ1

Ingress subnet: 1.1.1.0/24

Egress interface: DMZ2

Egress subnet: 2.2.2.0/24

The Source IP 1.1.1.1 initiated from DMZ1 should be natted to 3.3.3.1 upon exiting the Egress interface DMZ2.

Thanks.

Re: How to do souce address NAT

Mo'ath Al Rawashdeh — Thu, 05 Feb 2009 08:32:01 GMT

Hi,

What are security levels for the DMZ1 and DMZ2 intefaces?

Re: How to do souce address NAT

cisco_lite — Thu, 05 Feb 2009 08:36:50 GMT

DMZ1: 100

DMZ2: 70

Thanks.

Re: How to do souce address NAT

Mo'ath Al Rawashdeh — Thu, 05 Feb 2009 08:56:55 GMT

Hi again,

static (DMZ1,DMZ2)3.3.3.1 1.1.1.1 255.255.255.255

Cheers mate,

Muath

Re: How to do souce address NAT

Mo'ath Al Rawashdeh — Thu, 05 Feb 2009 09:02:30 GMT

And sorry for the 1,000 reply, by mistake mate 🙂

Re: How to do souce address NAT

Mo'ath Al Rawashdeh — Thu, 05 Feb 2009 09:02:51 GMT

Hi again,

static (DMZ1,DMZ2)3.3.3.1 1.1.1.1 255.255.255.255

Cheers mate,

Muath

Re: How to do souce address NAT

Mo'ath Al Rawashdeh — Thu, 05 Feb 2009 09:03:10 GMT

Hi again,

static (DMZ1,DMZ2)3.3.3.1 1.1.1.1 255.255.255.255

Cheers mate,

Muath

Re: How to do souce address NAT

Mo'ath Al Rawashdeh — Thu, 05 Feb 2009 09:03:13 GMT

Hi again,

static (DMZ1,DMZ2)3.3.3.1 1.1.1.1 255.255.255.255

Cheers mate,

Muath

Re: How to do souce address NAT

Mo'ath Al Rawashdeh — Thu, 05 Feb 2009 09:03:15 GMT

Hi again,

static (DMZ1,DMZ2)3.3.3.1 1.1.1.1 255.255.255.255

Cheers mate,

Muath

Re: How to do souce address NAT

Mo'ath Al Rawashdeh — Thu, 05 Feb 2009 09:03:19 GMT

Hi again,

static (DMZ1,DMZ2)3.3.3.1 1.1.1.1 255.255.255.255

Cheers mate,

Muath

Re: How to do souce address NAT

Mo'ath Al Rawashdeh — Thu, 05 Feb 2009 09:03:26 GMT

Hi again,

static (DMZ1,DMZ2)3.3.3.1 1.1.1.1 255.255.255.255

Cheers mate,

Muath

Re: How to do souce address NAT

cisco_lite — Thu, 05 Feb 2009 10:27:51 GMT

The syntax is incorrect. It should be

static (DMZ1,DMZ2)3.3.3.1 1.1.1.1 netmask 255.255.255.255

Secondly, the above isn't working. I debugged the packet and source address is not nat'ed.

I would be more interested on NAT'ing the network rather than the host, like with / 24.

Re: How to do souce address NAT

cisco_lite — Thu, 05 Feb 2009 19:03:57 GMT

I got the following from a NAT guide on the internet. Please advise if it is correct. I have tried it on FWSM and it is not working.

Please assist

Quote

Static source translation

Source static translation is used when the source IP address of the host (local IP) is

changed to another IP (global IP) once the packet gets routed to the destination. This

translation hides the real identity of the initiator and also allows private IP addresses

to be translated to public IPs in order to get routed through public networks.

Syntax:

#static(source_intf, destination_intf) netmask

Example:

//Host 10.0.0.100 is source translated when connects to another host situated behind dmz03

interface.

#static(inside,dmz03) 90.30.2.10 10.0.0.100 netmask 255.255.255.255

Unquote

Re: How to do souce address NAT

cisco_lite — Fri, 06 Feb 2009 00:26:51 GMT

I am coming across some materials stating that source address NAT'ing is not supported in FWSM. Is it true ? Please confirm. Thanks.

Re: How to do souce address NAT

Mo'ath Al Rawashdeh — Fri, 06 Feb 2009 11:54:47 GMT

Hi,

Is it possible that NAT is disabled on your FWSM?

If its disabled, while in config mode, do the "nat-control" command in order to enable it.

Cheers

Re: How to do souce address NAT

cisco_lite — Fri, 06 Feb 2009 13:15:03 GMT

nat-control means all packets that flow through the Security Appliance require a NAT rule, or the packets will be denied access through the appliance.

This is not the intention. I do not want all the traffic going thru the appliance to be NAT'ed.

So as long as the NAT rule exists, natting should take place even if the nat-control is disabled.

Re: How to do souce address NAT

Mo'ath Al Rawashdeh — Fri, 06 Feb 2009 13:22:40 GMT

Mate,

Can you please send me a link that explains this? As this is the 1st time to hear this.

I believe that if nat-control is disabled, no nat is going to take place on the firewall.

However, if nat-control is enabled and yet, some IP addresses need not to be natted, you may use nat exclude.

Cheers mate.

Re: How to do souce address NAT

Mo'ath Al Rawashdeh — Fri, 06 Feb 2009 13:42:00 GMT

Mate,

Lets sum things up, your requirement is that when a host in DMZ1 (1.1.1.0/24) connects to a host in DMZ2 (2.2.2.0/24), the IP address of the host from DMZ1 (1.1.1.0/24) is NATed to 3.3.3.1?

Re: How to do souce address NAT

cisco_lite — Fri, 06 Feb 2009 13:43:29 GMT

The link is as follows

http://www.cisco.com/en/US/docs/security/fwsm/fwsm31/configuration/guide/intfce_f.pdf

Please see page 6-1.

Re: How to do souce address NAT

cisco_lite — Fri, 06 Feb 2009 13:47:37 GMT

Minor correction..

Host in DMZ1 connects to any host routed through DMZ2 (i.e. could be multiple hops away), the IP address of the host from DMZ1 should be NAT'ed to for e.g. 3.3.3.1

Also, I would like the NAT to occur on network level and not host.

Similar example in router IOS would be

ip nat inside source static network 192.168.10.0 172.16.1.0 /24

This caters to bi-directional NAT'ing. I would like to achieve the same in FWSM.