ASA 9.3 reverse NAT

[hoffa2000]

Hi folks

Can ASA do "reverse NAT"? Vendors have different names for this but what I want to do is have my ASA translate incoming traffic from Internet to an internal IP but have the traffic appear to the internal server as coming from the internal interface of the ASA.

Regards

Fredrik

[Stefan Menning · Accepted solution]

 What do you mean by "comming from the internal Interface of the ASA"? Do you want the internal Server to see a soure ip from the same Network that asa internal Interface is in? Or do you want the source address to be the actual asa interal Interface ip?

Generally you should be albe to acomplish this task with "twice NAT" (http://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/firewall/asa_91_firewall_config/nat_rules.html), but I'm not sure if it works with the asa-interface-ip.

[hoffa2000]

Hi Stefan. Thank you for the pointer. It doesn't have to be the same IP as the ASA internal interface, could be any available IP on the internal network. I'll take a look at the twice NAT concept.

/Fredrik

[hoffa2000]

Hi

Through some trial and erroring I managed to get it up and running. The below command allow any external IP to send email to my internal server using the firewall internet interface IP, the connection is then sent to my mail server using the firewall internal interface IP as source. 

nat (outside,inside) source dynamic any interface destination static interface Internal-IP-Of-Server service SMTP SMTP

Great stuff!