topic Re: NAT Exemption in Network Security

NAT Exemption

mchockalingam — Tue, 26 Mar 2019 00:37:40 GMT

Hi All,

I jsut need some help in making sure that the following statements are correct. Here is the scenario.

Our inside private addresss 10.x.x.x always gets NATed to a public IP on the outside. Now I have a situatuion where we do not want to NAT the private IP if the destination address is x.x.226.31 on the outside.

I have come up with the following.

access-list no_nat_ipvc_out permit ip 10.0.0.0 255.0.0.0 host x.x.226.31

nat (inside) 0 access-list no_nat_ipvc_out

Will this work?

Re: NAT Exemption

acomiskey — Tue, 22 May 2007 11:57:20 GMT

Yes.

Re: NAT Exemption

hoogen_82 — Tue, 22 May 2007 12:00:00 GMT

Yeah that should do it.

-Hoogen

Re: NAT Exemption

mchockalingam — Wed, 23 May 2007 13:43:11 GMT

Thank you for both replies.

I have another situation but do not know how to do the translations for.

I have remote access VPN users getting public ip addresses in the range x.x.26.0/23 on the outside. They need to access their desktops on the inside using RDP and the desktops are on the private 10.x.x.x range.

Is it possible to allow remote access users on the outside to access the desktops on the inside?

I have been looking into policy NAT but need some help.

Any suggestions?

Re: NAT Exemption

acomiskey — Wed, 23 May 2007 14:32:32 GMT

I think this is what you're asking. Just add the traffic to you existing nat exemption acl.

access-list no_nat_ipvc_out permit ip 10.0.0.0 255.0.0.0 host x.x.226.31

access-list no_nat_ipvc_out permit ip 10.0.0.0 255.0.0.0 x.x.226.0 255.255.254.0

nat (inside) 0 access-list no_nat_ipvc_out

Re: NAT Exemption

mchockalingam — Wed, 23 May 2007 15:01:23 GMT

I think this will only allow 10.x.x.x access the 26.0/23 with no NAT.

But I would like to no NAT the 10.x.x.x on the inside if the traffic is coming from the outside source x.x.26.0/23. I do not have any interface in the 10.x.x.x range on the firewall.

We are doing the NATing on the FWSM but the perimeter firewall has the DMZ which has our VPN device. When remote users connect they get an IP on the DMZ of the perimeter firewall and the users need access to inside which is 10.x.x.x. But all our 10.x.x.x gets NATed to a public IP by the FWSM.

Re: NAT Exemption

acomiskey — Wed, 23 May 2007 15:37:45 GMT

Nat exemption acl's are bi-directional.

Re: NAT Exemption

mchockalingam — Wed, 23 May 2007 17:42:27 GMT

This is a learning for me. I just want to make sure that it will work if the traffic originates from outside.

Re: NAT Exemption

joe2065 — Wed, 23 May 2007 18:38:51 GMT

How are doing Meena im dillonoct@aol.com