Re: asa 5510 nat

jschweng · ‎12-16-2010

we have an ASA5510 cluster pair with our managment network behind it. There is one server on the inside interface that has to provide network management to serveral remote networks. Each network is connected through routers directly attached to seperate interfaces on the ASA's. However two of hte networks are using identical subnets so we need to NAT. we have to be able to route out to the remote networks from the mgt network, and receive in snmp traps.

So could we configure a one to one NAT on the ASA's outside interface to one of the remote networks?

If the network is for example 192.168.1.0 at both remote sites, the interfaces were RM2 and RM2, if we were to static NAT this network to 192.168.2.0 - then what routes would we put on the asa?

would we add one route to 192.168.1.0 out RM1 and one to 192.168.2.0 out RM2?

Maykol Rojas · ‎12-16-2010

Hi Martin,

I hope you are doing fine. So, it is like you have to manage some routers that are attached to different interfaces of the firewall, but, 2 of the routers have the same subnet as the internal server is that correct?

Could you attach a diagram of what you are trying to do? I think one thing that you can do is apply a policy nat so your management server is translated to a different IP when they are going to the subnets in conflict.

Let me know.

Mike

Renato Morais · ‎12-16-2010

Let's use your example. The network address is 192.168.1.0 at both remote sites and you have the interfaces RM1 and RM2 connected to the routers. Let's say that the addresses of the routers are 192.0.2.254 and 192.0.3.254. You can set the ASA to route the traffic to both networks using the following commands:

static (RM1,inside) 192.168.1.0 192.168.1.0 netmask 255.255.255.0
static (RM2,inside) 192.168.2.0 192.168.1.0 netmask 255.255.255.0

!

route RM1 192.168.1.0 255.255.255.0 192.0.2.254 1
route RM2 192.168.1.0 255.255.255.0 192.0.3.254 2

You won't see the route for RM2 in the routing table, nevertheless it will be used because the static statement forces the traffic to go through that interface.