cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

Welcome to Cisco Firewalls Community


697
Views
0
Helpful
1
Replies
Beginner

Pretty sure this won't work, but... ASA 5540 static NAT public IP to private remote MPLS host

We have two ISP entry points (two separate networks, no BGP for the WAN IP's) on our network connected by an MPLS cloud.

(Teh Internets) <--> [Edge Router A] <--> [ASA 5510 A] <--> [Layer 3 Core Switch w/hosts A] <--> [MPLS Router A]  <--> [MPLS Router B] <--> [Layer 3 Core Switch with hosts B] <--> [ASA 5540 B] <--> [Edge Router B] <--> (Teh Internets again!)

Essentially, my question is:

Can we create a static Public to Private NAT Translation from a public address on [ASA 5540 B] to a host on [Layer 3 Core Switch with hosts A]?

Let's say the outside IP is 12.12.12.12, the inside interface is 172.20.20.1/24 and the MPLS host is 192.168.20.20.

The desired translation is: 

static (inside,outside) 12.12.12.12 192.168.20.20 netmask 255.255.255.255 dns

We can ping the host in question from the inside interface of [ASA 5540 B].

Currently, I'd imagine this not working because ultimately one of the routers would see a request from 192.168.20.20 and continue routing it back to segment A, and it would never get back to segment B.  There's a couple of ways around this, and all involve using a private IP on host B for the translation, but I don't want to create a bunch of NAT statements across our MPLS network.

Again, I don't think this can work, but I'm hoping again hope that there's a way.

Thoughts?

Everyone's tags (8)
1 REPLY 1
Cisco Employee

Pretty sure this won't work, but... ASA 5540 static NAT public

The answer to your question is yes, you can NAT host A on ASA 5540 B.

However, how are you routing the traffic from host A. What is the default gateway for host A? If default gateway for host A is the MPLS Router A, and it routes towards MPLS Router B and so on towards Internet B, then yes, it would all work.

However, if default gateway of host A is ASA 5510A, then you might need to change the default gateway to MPLS Router A, and if MPLS Router A default route is somewhere else but MPLS Router B, then you might want to do some PBR for hostA so it is being routed towards ASA5540B.