topic Re: Multiple private subnets to multiple public IP - ASA 5508-X in Network Security

Multiple private subnets to multiple public IP - ASA 5508-X

Naoum_George — Fri, 21 Feb 2020 15:56:03 GMT

Hello,

I am planning to replace 2 microtick routers with an ASA 5508-X.

I have different subnets in my lan 172.16.10.0/24, 172.16.20.0/24 up to 172.16.60.0/24. Also I have a range of public IP from ISP with x.x.x.x/28.

I want each sub net to get out to internet with a different public IP from the ones I have.

Can it be done? How.

Thanks

Re: Multiple private subnets to multiple public IP - ASA 5508-X

Rob Ingram — Fri, 29 Jun 2018 12:57:17 GMT

Hi,

Assuming your internal interface leading to your LAN is called INSIDE and your interface leading to the internet is called OUTSIDE, the configuration below should work. If you name the interfaces differently, you'd need to change the nat syntax accordingly.

object network NET_172.16.10.0
subnet 172.16.10.0 255.255.255.0
nat (INSIDE,OUTSIDE) static 1.1.1.2

object network NET_172.16.20.0
subnet 172.16.20.0 255.255.255.0
nat (INSIDE,OUTSIDE) static 1.1.1.3

object network NET_172.16.60.0
subnet 172.16.60.0 255.255.255.0
nat (INSIDE,OUTSIDE) static 1.1.1.4

interface GigabitEthernet0/0
nameif OUTSIDE
security-level 0
ip address 1.1.1.1 255.255.255.0

interface GigabitEthernet0/1
nameif INSIDE
security-level 100
ip address 172.16.0.1 255.255.255.0

HTH

Re: Multiple private subnets to multiple public IP - ASA 5508-X

Naoum_George — Fri, 29 Jun 2018 20:19:54 GMT

I was using the following command so that the specific subnet on the inside interface to have access to the internet using the IP of the outside interface. What is the difference?

object network Inside-Subnet
nat (Inside,Outside) dynamic interface

Thank you.

Re: Multiple private subnets to multiple public IP - ASA 5508-X

Rob Ingram — Fri, 29 Jun 2018 20:25:17 GMT

All subnets you defined in the object "Inside-Subnet" will be natted behind the ip address of the outside interface. Which is not what you initially said you wanted.

Re: Multiple private subnets to multiple public IP - ASA 5508-X

Naoum_George — Fri, 29 Jun 2018 20:40:45 GMT

I am sorry, I did not expressed myself correctly in my reply. If IP of outside interface is 1.1.1.2 , and inside-subnet is 172.16.10.0 255.255.255.0, what is the difference of the two commands? Will both sub nets be natted behind the same IP? The second command is used when we want to nat a subnet behind an IP that is part of the range that the outside interface also belongs?

object network Inside-Subnet
nat (Inside,Outside) dynamic interface

object network NET_172.16.10.0
subnet 172.16.10.0 255.255.255.0
nat (INSIDE,OUTSIDE) static 1.1.1.2

Thanks

Re: Multiple private subnets to multiple public IP - ASA 5508-X

Rob Ingram — Fri, 29 Jun 2018 20:45:27 GMT

If the outside interface ip address is 1.1.1.2, then effectively those 2 nat examples achieve the same result, outbound traffic from the defined subnet would be natted on the address 1.1.1.2.