I have ASA 5520 running 8.3.2 with the following interfaces. All that I need is the best practice so that host in each network can communicate to other networks vise-versa. I want the networks to communicate bidirectional to each other. And the users in the internal network be able to reach all the networks. No port restriction at this point and all communication is network based not specific server or users for testing purposes.
| 10.10.21.0/24 network
|
level 0 Outside |
|
| 10.10.20.5/24 level 75 Inter Internal network
--------------------------- 10.10.25.6/24 ---------- 192.168.50.0/24
|192.168.46.5/24
Inside Level 100 |
|
|
| 192.168.26.0/24
int g0/0
Nameif Outside
security level 0
Ip adress 10.10.20.5/24
Int g0/1
Nameif Inside
security level 100
IP address 192.168.46.5/24
Int g0/2
nameif Internal
Ip address 10.10.25.6/24
route 0 0 10.10.20.4
route 10.10.21.0 255.255.255.0 10.10.21.4
route 192.168.50.0 255.255.255.0 192.168.50.4
What is the best practice to create a generic communication between the networks, Nat exempt or Manual NAT?:
object network <inside-object>
subnet 192.168.46.0 255.255.255.0
object network <destination-object>
subnet 10.10.20.0 255.255.255.0
nat (any,any) source static inside inside destination static Outside Outside
nat (<source interface>,<destination interface>) source static <inside-object> <inside-object> destination <destination-object> <destination-object>
object network <Outside-object>
subnet 10.10.20.0 255.255.255.0192
object network <destination-object>
subnet 192.168.46.0 255.255.255.0
nat (any,any) source static Outside Outside destination static inside inside
nat (<source interface>,<destination interface>) source static <inside-object> <inside-object> destination <destination-object> <destination-object>
