ASA IOS 8.6 NAT question

[fsebera]

Hi,

I think I need to NAT the source and destination of packets and was hoping someone would assist.

My firewall is an ASA 5512-x with Internet facing "outside" interface IP address of 1.0.0.1/28 (for this example)

I need ALL external Internet hosts to reach my private web server at 172.16.5.45.

My remote web server routing infrastructure cannot use the default route (0.0.0.0/0) due to multiple return paths so a static route of 1.0.0.1/32 will be used to return traffic back to the ASA firewall.

Should I use static twice nat for this setup of some other type of Cisco ASA IOS 8.6 supported NAT?

Thank you

Frank

[Jon Marshall]

Frank

So you have an internal web server that would not send it's return traffic to the firewall's inside interface ?

If so you have two choices -

1) if the L3 device that is the default gateway of the web server supports PBR you could use that to send the traffic back to the ASA although that does depend on the source IP addresses

2) you can overload all incoming IPs to the inside interface IP of your ASA or another IP address but not an IP from the outside subnet, that does not make sense.

You would either use the ASA inside IP address as I say, a spare IP from that IP subnet or an entirely new IP from a new subnet.

Whichever you use you just need to make sure it is routed back to the inside interface of your ASA.

So yes you would need to NAT the web server IP to the outside and you would also need to NAT all incoming source IPs to an IP that gets routed back to the ASA.

If you do overload all IPs bear in mind that depending on the amount of connections to that web server your ASA could end up with quite a few translations.

Jon

[fsebera]

Hi Jon,

After reading your response again after writing my reply, I feel you understand my issue but wanted to send this any way hoping I could get some actual ASA syntax!!! :)

Internet sources will reach my Internal web server (172.16.5.45, or dns name Donsee) by setting their browser to http://1.0.0.1. (or www.donsee.org). The source Internet traffic is routed to 1 of 2 of my ASA firewalls.

[My ASA firewalls do not share state, don't know about each other and are separated by several hundred miles.]

ASA1 Outside Public IP address = 1.0.0.1

ASA2 Outside Public IP address = 2.0.0.2

ASA1 receiving the initial packet will NAT the destination of 1.0.0.1 to 172.16.5.45 and forward the packet to the next hop. Once the packet is received by Donsee, Donsee will reply with the web page contents and forward to its configured default gateway. --- Now this is where it get fuzzy. Donsss's default gateway router R1 does not have a Gateway of Last resort (0.0.0.0/0). R1 not having a gateway of last resort drops the packet.

R1 does not have a Gateway of Last resort because both of my ASAs (ASA1 and ASA2) route traffic to R1. If R1 had a Gateway of Last Resort (0.0.0.0/0), returning traffic to an incorrect ASA will fail because the firewalls do not share state. This is our known issue and cannot be fixed in the short term.

If the ASAs (ASA1 and ASA2) could NAT both the Destination to 172.16.5.45 AND the SOURCE of packets with their "Outside" interface address, Providing R1 with the 2 IP host addresses of 1.0.0.1/32 and 2.0.0.2/32 pointing to the correct forwarding path, this will solve the problem.

I am struggling with the mechanics of ASA NAT to make this happen.

Thanks again for your assistance.

Frank

[Jon Marshall · Accepted solution]

Frank

Using the outside IP address still doesn't make sense.

What you want is to translate all incoming source IPs to the inside interface of the ASA so that traffic is automatically routed back to the correct ASA.

So see this discussion for the syntax -

https://supportforums.cisco.com/discussion/11818646/help-slow-access-or-nat-inside-interface-asa-91

Jon

[fsebera]

Hi Jon,

Ahhh, so you're saying to translate the original packets SOURCE IP to the ASA "Inside" interface not the "Outside" - Ok this is doable too.

Thanks for the link, I'll read it over and be back for additional questions!! in a new message!!

Thanks

Frank