ASA NAT Exemption

[Gordon Ross]

I'm running ASA software 8.4(2)

I've setup the anyconnect VPN system, and it works fine. However, it's NATing to the inside interface of the ASA. How do I do the NAT exclude ?

The docs say you *used* to do:

access-list no_nat permit ip 192.168.0.0 255.255.255.0 any

nat (inside) 0 access-list no_nat

However, with the latest software, this isn't valid any more.
I tried:

object network SSLVPN
  subnet 192.168.0.0 255.255.255.0
nat (inside,any) source static SSLVPN SSLVPN no-proxy-arp

But my packets are still getting NATed.

Suggestions, please ?

Thanks,

GTG

[varrao · Accepted solution]

Hi Gordon,

You might wanna try this:

Lets you had the following nat statement in the previous code:

access-list SSLVPN permit ip 10.0.0.0 255.0.0.0 20.0.0. 255.0.0.0

nat (inside) 0 access-list SSLVPN

The new NAT would be:

object network internal_subnet

  subnet 10.0.0.0 255.0.0.0

object network remote_network

  subnet 20.0.0.0 255.0.0.0

nat (inside,outside) source static internal_subnet internal_subnet destination static remote_network remote_network

Hope this helps.

Thanks,

Varun

[varrao]

Here's a doc as well, PFA

-Varun

Please rate helpful posts.

[Gordon Ross]

object network internal_subnet
  subnet 10.0.0.0 255.0.0.0
object network remote_network
  subnet 20.0.0.0 255.0.0.0
nat (inside,outside) source static internal_subnet internal_subnet destination static remote_network remote_network

So is the remote_subnet the ip pool subnet that the VPN clients are assigned by the ASA, and the internal_subnet the subnet the VPN clients want to access ?

GTG

[varrao]

Yes, absolutely, if you are doing remote access vpn.

Thanks,

Varun