ASA VLAN Tagging and NAT-ing

[George-Sl]

Hello,

I am trying to figure what would be the ASA configuration that could do the same thing this watchguard does, I need the configuration.

that Fa0/0 carries vlan 10, 20 ,30 and they are just vlans, fa0/0 interface is probably a router on stick so it's probably tagged per sub interface, and vlan 701 is the vlan that can carry us to the internet and our public facing ip address is 18.2.211.55 which we try to nat all of our inside networks to that. our inside networks are (vlan 10=192.168.10.0, vlan 20= 192.168.20.0, vlan 30= 192.168.30.0)

Vlan 444 is the management vlan.

and int Fa0/1 is trunk as well and that cisco 48 port switch is L2,

so I don't know the config on the fast interfaces

and I don't know what should I put in that object network .... NAT(xx,xx) command

and about that Public IP 18.2.211.55, I heard from the designer that it's on vlan 701, doesn't make sense to me, so I could be wrong, if you can figure the architecture here as well would be good too

[balaji.bandi]

You can configure ASA as per the below  example config - change the security levels and nameif as per the requirement.

Before you go live test offline.

interface GigabitEthernet0/0
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/0.10
vlan 10
nameif BBVLAN10
security-level 50
ip address 192.168.10.1 255.255.255.0
!
interface GigabitEthernet0/0.20
vlan 20
nameif BBVLAN20
security-level 50
ip address 192.168.20.1 255.255.255.0
!
interface GigabitEthernet0/0.30
vlan 30
nameif BBVLAN30
security-level 50
ip address 192.168.20.1 255.255.255.0

[Marius Gunnerud]

If you are just looking to NAT for internet access then you can do the following

object network 192.168.10.0_24

  subnet 192.168.10.0 255.255.255.0

  nat (inside,outside) dynamic interface

Just change the interface names inside (source) and outside (destination). And if you want to NAT to an IP other than the outside interface IP you can create a different object and reference that instead of "interface"