06-22-2021 01:52 AM - edited 06-22-2021 01:57 AM
Dear colleagues,
on Cisco FTD it is a bit tricky to implement NAT-rules, please help me to understand how to do this.
I attached the picture. Here we have two sites, connected via ISP. On each site we have Cisco FTD and server. Servers should initiate a session between them with the private IPs. So the packet from Server 1 will be originated with src IP 192.168.1.2 and dst IP 192.168.2.2, similar on the Server 2 src IP 192.168.2.2 dst IP 192.168.1.2. 192.168/16 networks are not routed in the cloud. So I think to do like that: when FTD1 receives packet from the Server-1, it should change dst IP to 10.1.2.3 (free, unassigned IP address from the prefix on the outside interface of FTD2), keep src IP as 192.168.1.2 and send to the cloud, cloud sends it to the FTD2. FTD2 should again change dst IP from 10.1.2.3 to 192.168.2.2 and send to Server-2. The same should happen on on the reverse path: Server 2 sends packet with src IP 192.168.2.2 dst IP 192.168.1.2 to FTD2, FTD2 changes dst IP from 192.168.1.2 to 10.1.1.3, keeps the source IP as 192.168.2.2 and sends to the cloud, cloud sends to the FTD1, FTD1 changes dst ip from 10.1.1.3 to 192.168.1.2 and sends to the Server 1.
Kindly advise, which rules should work here?
Solved! Go to Solution.
06-22-2021 02:52 AM
You'll need to translate the source and destination.
I've provided the ASA syntax example below, which should be easy enough to translate to FTD NAT configuration.
nat (INSIDE,OUTSIDE) source static <ORIGINAL SRC> <TRANSLATED SRC> destination static <ORIGINAL DST> <TRANSLATED DST>
ORIGINAL src=192.168.1.2
TRANSLATED src=10.1.1.3
ORIGINAL DST = 192.168.2.2
TRANSLATED DST = 10.1.2.3
The example above is for FTD1, you'll need to mirror this configuration on the other FTD, swapping the src and dst accordingly.
06-22-2021 02:49 AM
This is a good start for you. kind of think what you want
06-22-2021 02:52 AM
You'll need to translate the source and destination.
I've provided the ASA syntax example below, which should be easy enough to translate to FTD NAT configuration.
nat (INSIDE,OUTSIDE) source static <ORIGINAL SRC> <TRANSLATED SRC> destination static <ORIGINAL DST> <TRANSLATED DST>
ORIGINAL src=192.168.1.2
TRANSLATED src=10.1.1.3
ORIGINAL DST = 192.168.2.2
TRANSLATED DST = 10.1.2.3
The example above is for FTD1, you'll need to mirror this configuration on the other FTD, swapping the src and dst accordingly.
06-22-2021 03:04 AM
Hello Rob,
thank you, it works! But is it possible to keep the src IP unchanged during the NAT? Don't know for what reason, but just "academic" curiosity, is it possible?
06-22-2021 03:09 AM
No, you said the 192.168/16 network is not routed in the cloud, so it won't know how to route the traffic. If it was you wouldn't need these nat rules in the first place!!
06-22-2021 03:44 AM
Why not, destination IP would be still changed, routing works based on the destination IP (except some weird PBR things), so it would be routed to the end.
06-22-2021 03:48 AM
because the destination needs to know how to route back to the source and if the source was the 192.168/16 ip address that is not routable in the cloud, the destination won't know where to send the response. Hence why you need to NAT on both ends.
06-22-2021 03:55 AM
Desitnation is the Server-2 and it has default route via FTD-2, on FTD-2 there will be NAT rule, which changes dst IP from 192.168.1.2 to 10.1.1.3. Where am I wrong?
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide