Using inside interface IP address for PAT

bhogue — Fri, 21 Feb 2020 15:59:45 GMT

Hi all,

I have a direct connection to a remote vendor from my ASA 5516 (9.5(2)) for a hosted web based application. I need to add an IP on my inside interface (192.168.2.26) to use for a PAT address to the vendor. This is the path:

Client (192.168.1.0/24) -> Core switch (192.168.2.1/24) -> Firewall inside interface (192.168.2.25/24) -> Firewall vendor interface (10.10.10.101/29) -> Vendor firewall(10.10.10.97/29) -> Web App (10.10.11.0/24)

This is what I've tried but it isn't working:

route inside 192.168.1.0 255.255.255.0 192.168.2.1 1

route vendor 10.10.11.0 255.255.255.0 10.10.10.101 1

object network VENDOR_LOCAL_PAT
subnet 192.168.1.0 255.255.255.0
object network VENDOR_REMOTE_PAT
subnet 10.10.11.0 255.255.255.0
object network VENDOR_PAT_IP
host 192.168.2.26
nat (inside,vendor) source dynamic VENDOR_LOCAL_PAT VENDOR_PAT_IP destination static VENDOR_REMOTE_PAT VENDOR_REMOTE_PAT

Can someone tell me what I'm doing wrong?

Thanks,

Bill

Re: Using inside interface IP address for PAT

Jewgeni Uschegow — Tue, 17 Jul 2018 20:22:02 GMT

Hi Bill,

the nat rule look ok, but I think that route to vendor is false. Can you try:

> route vendor 10.10.11.0 255.255.255.0 10.10.10.97 1

Best regards,

topic Using inside interface IP address for PAT in Network Security

Using inside interface IP address for PAT

Re: Using inside interface IP address for PAT