ASA 5505 Using Class C Address on LAN ?? Can you help.

[russ]

Hi, I have a Cisco ASA 5505, running 9.2(3) / 7.3(3).

Our ISP gave us a routable Class C Address (254) usable.

I would like to use these public routable addresses on the LAN (INSIDE) interface of the ASA.

Since these addresses are routable, I don't want to use NAT.

The LAN clients / servers:

Clients: (5) Windows  Clients, & 1 Mail Server.

I need all LAN (Inside clients) to access internet for browsing.

I need to block all traffic coming from the Internet to Windows Clients, but allow Port 3389 (Remote Desktop), and port 25 for SMTP mail.

There is also a Site to Site VPN to another ASA 5505 (same IOS/ASDM).

What is the best way to do this? Static Identity NAT, or NAT Exemption ??

I would like to avoid NAT, completely since I have the luxury of 254 routable public IP Addresses

Thanks.
 

[Marvin Rhoads]

You can use the addresses natively - just don't put any NAT rules in the config.

You will have to subdivide the /24 into subnets so that the ASA knows which ones to route out the Internet-facing interface and which go to the inside network.

Then just put the security policy you want into the access-list.