topic Re: Allowing Natted IPs through ASA? in Network Security

Allowing Natted IPs through ASA?

CiscoBrownBelt — Fri, 21 Feb 2020 17:11:06 GMT

You must still use the natted IP not the real source IP in the access-rules correct?

Re: Allowing Natted IPs through ASA?

Rob Ingram — Fri, 31 May 2019 14:16:46 GMT

Hi,
No, you always use the real IP address in the ACL not the natted ip address.

I believe older version of ASA, v8.2 (from memory) however was different in regard to NAT. I assume you have a relatively new 9.x version of ASA? In which case use the real IP address.

HTH

Re: Allowing Natted IPs through ASA?

CiscoBrownBelt — Fri, 31 May 2019 14:55:45 GMT

Just so I can clarify, so if the IPs are being Natted prior to the FW you need to enter the original IP?

Re: Allowing Natted IPs through ASA?

Rob Ingram — Fri, 31 May 2019 17:48:06 GMT

Oh ok sorry, you mean the firewall itself is not doing the nat translation? If this is inbound traffic, and the ASA is not doing any NAT translation/un-translation, then the ASA would only know the public IP address - therefore the ACL rule should reference the only IP address it recieved traffic from (the public IP address).

Re: Allowing Natted IPs through ASA?

CiscoBrownBelt — Tue, 04 Jun 2019 02:13:33 GMT

Yes sorry I should have clarified but awesome thanks!

Just created another post, but what if I want to NAT an internal IP address to another IP address that should be allowed to transverse an IPSEC tunnel on an ASA? Example, I have 160.1.1.10 address that I want to be Natted to 170.1.1.10 which is an source IP allowed to reach 200.1.1.10 destination IP of the IPSEC tunnel?

In addition to my NAT statement which is:

"Object-Nat" natting static 160.1.1.10 to 170.1.1.10 and choosing Inside interface as source interface (160.1.1.10 host is in the Inside interface) and Outside interface (IPSEC tunnel starts/exits Outside interface on both Local and Remote Tunnel/ASA devices,

Do I need to create another ACL rule which would be applied to the Crypto Map ACL or no since the Crypto Map ACL is already defining/allowing source address 170.1.1.10 to reach remote destination IP 200.1.1.10?