topic Re: Understanding difference between these two NAT statements in Network Security

Understanding difference between these two NAT statements

Madura Malwatte — Fri, 21 Feb 2020 17:41:21 GMT

I am just trying to understand the difference between the below two NAT statements. As far as I can tell both seem identical?

Number 1. allows any outside ip to hit the public ip of FTD 104.4.4.4 on port 80 which gets translated to destination of web_server port 80.

Number 2. translates the web_server port 80 to public 104.4.4.4 port 80. so anyone from outside can hit 104.4.4.4 and access the web-server.

What's the difference between these two, am I missing something?

Re: Understanding difference between these two NAT statements

Marvin Rhoads — Tue, 12 Nov 2019 03:07:21 GMT

Neither one is the recommended configuration.

In the first case the logic is "outside,inside". You have both an original service and http application specified. In the second case, the logic is "inside,outside" but it specifies the service as only tcp/80. So if the web server as trying to reach the Internet for any other services it would not hit the NAT rule and would instead use whatever global NAT (if any) you have configured.

Recommended would be to have an "inside,outside" NAT rule (ideally using a DMZ and not the whole inside network to limit exposure). Combine that with an Access Control Policy entry allowing the incoming traffic via http application only.

Re: Understanding difference between these two NAT statements

Madura Malwatte — Wed, 11 Dec 2019 22:28:01 GMT

Hi @Marvin Rhoads , thanks for the response. This was just an example and understood about the best practice to NAT from the dmz.

However in terms of the two NAT statements, is there a recommended way to configure it - "outside,dmz" or "dmz,outside" if we are trying to reach a web service in the dmz from public?

Refer to the image, I see no difference in the what these NAT statements will do, but which way is the recommended way to configure? I will have ACP rules to only permit public access to dmz server on http.

Re: Understanding difference between these two NAT statements

Marvin Rhoads — Fri, 13 Dec 2019 02:46:01 GMT

"dmz,outside" would be the recommended method and they way I have used and seen used on 99% of the hundreds of ASA and FTD deployments I've done.

Re: Understanding difference between these two NAT statements

Madura Malwatte — Sun, 15 Dec 2019 23:09:26 GMT

Hi Marvin,

Thanks for confirming.