cancel
Showing results for 
Search instead for 
Did you mean: 
cancel

ASA NAT - Source address translation

Paul Masterton
Beginner
Beginner

Hi All,

I've a quick - I think - ASA NAT question. I have a server in a DMZ of my 8.4 ASA with nat:

object network FTP-SERVER

     host 192.168.1.102

     nat (dmz,outside) static interface tcp ftp ftp

And that's working well. However, I now need to translate the source address of connections from the outside to the FTP server as well. The aim is that the source address of packets when they reach the FTP server is an address on the DMZ subnet (as the default route for the FTP server now needs to be something else, not the ASA) as well as this outside-dmz NAT. I thought overloading the DMZ interface of the ASA? Or another IP in that range?

Is this a twice-nat issue?

I'm not too sure where to start!

Cheers for your help!

1 ACCEPTED SOLUTION

Accepted Solutions

Jennifer Halim
Cisco Employee
Cisco Employee

On top of the above NAT rule, you can configure the following:

object network obj-outside-dmz

   subnet 0.0.0.0 0.0.0.0

   nat (outside,dmz) dynamic 192.168.1.x

where 192.168.1.x is a spare ip address in dmz network.

Then "clear xlate" after the addition.

View solution in original post

2 REPLIES 2

Jennifer Halim
Cisco Employee
Cisco Employee

On top of the above NAT rule, you can configure the following:

object network obj-outside-dmz

   subnet 0.0.0.0 0.0.0.0

   nat (outside,dmz) dynamic 192.168.1.x

where 192.168.1.x is a spare ip address in dmz network.

Then "clear xlate" after the addition.

Thanks, that's a much more ellegant answer than where I was going with this!

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: