how to nat outside ip address to outside address of different asa

[sebastianvandijk]

We have the following scenario:

Site01 is our primary site containing a webserver behind an ASA.

This Webserver is statically natted to an outside address.

A DNS address is pointing to this outside address.

Site02 is our backup site containing the same setup except ip addresses.

Now i want to be able to have Site02 alive while having maintenance on the web server on site 01.

My idea was to create a static nat rule from Site01 to Site02, so clients do not have to change dns addresses.

But then again, site 02 has to send the response back to Site01 so the first NAT should be source natted and destination natted i guess, otherwise the client would receive a response from a different ip than the one they send the request to.

Is this a possible scenario ? And how do i configure this ?

[Julio Carvajal]

Hello Sebastian,

So you basically want to use the secondary site when primary site is in maintanance.

I do not understand what you are attempting to do with the NAT so I would say I do not think it will work.

My recommendaton instead is to map that to DNS entry to port 80 on that primary server and then on 8080 on the secondary server for the same service (pointing to the same IP address and same Domain name)

Regards,

Jcarvaja

[sebastianvandijk]

I want to use that NAT so for the client, the destination and source address do not change.

As our customers use firewalls for incoming and outgoing traffic.

The DNS mapping thing, you mean port address translation ? Then the same issue arises for returning traffic isn't it ?

[Jouni Forss]

Hi,

I dont think you can configure a  Static NAT with the same public IP address for 2 different local  servers and have them work at the sametime.

You will probably end only one  of them working and the other one not. It might even be that the device  itself wont allow you to enter the second configuration.

You could probably configure  Static NAT for two different servers if you used the source address  where the connections are coming from as a parameter of the NAT but in  this case that wouldnt really make sense.

I am not really familiar with  the DNS side (except for the very basics) but wouldnt it be possible to  have different public IP addresses on the DNS servers for the same DNS  name? Or would this just create other problems that would need to resolved again?

For example doing a DNS Lookup for www.google.com produces 6 public IP addresses for me

- Jouni

[sebastianvandijk]

Hi Jouni,

I don't want site01 and site02 servers to be working at the same time.

So the idea was to run some lines of config at the moment of switching :

- disabling the nat rule at site01 to that webserver

- configuring the nat rule at site01 for the remote webserver

But then still, if i manage to create a static nat from an external ip at site01 to an external ip at site02, and site02 maps that external ip to the inside host,  when the host responds, it will send traffic out directly to the client thus giving an answer on a different ip address than the request was send to.

[Jouni Forss]

Hi,

The problem with the setup your are attempting is simply the fact that you are trying to configure Static NAT that use the same public IP address and expect the ASA to be able to determine which should be used and when. I don't see an automatic way switch this configuration on the ASA itself.

There was a similiar discussion here not long ago. There I simply stated that if the ASA had the same support as the IOS Routers then you could probably create a combination of SLA and some script that changes the NAT configuration to point to the other site when the main sites server is unreachable. But as of now this is not possible on the ASA.

Naturally the setup between the sites requires some thought also. From your explanation I gather that you are actually testing Static NAT that forwards connections coming to the public IP address of the server on the Main Site to the public IP address on the Secondary Site. This would naturally result in a situation where the Secondary Site server forwards the traffic out the local Internet connection directly to the host/client on the Internet. To avoid that you would have to NAT the source address also on the Main Site so all return traffic from the Secondary Site would be forwarded back to the Main Site before getting forwarded back to the host/client that initiated the connection.

But as I said, I am not sure if the ASA really provides tools to accomplish what you are asking at the moment. Or I am just missing something which is also possible

Naturally it might be possible to create some script that logs into the ASA and changes the NAT configurations when this change is needed.

- Jouni

[sebastianvandijk]

Hi Jouni,

The switching between primary and secondary site would be a manual action.

My main concern is the source nat configuration on the main site for the returning traffic.

Is that possible ?

So ; External IP on Site01 is natted to External IP on Site02 but is source natted also.

[Jouni Forss]

Hi,

To my understanding you would require the following configurations

• Static NAT that binds Main Site public IP to Secondary Site public IP
• Dynamic Policy PAT user source addresses when contacting the Main Site IP so return traffic flows from Secondary Site to Main Site

I can't guarantee these 100% but to my understanding these should be it

Static NAT for Main Site to Secondary Site

same-security-traffic permit intra-interface

static (outside,outside)

netmask 255.255.255.255

Dynamic Policy PAT for source translation

access-list WEB-SRV-POLICYPAT remark Dynamic Policy PAT for Web user traffic

access-list WEB-SRV-POLICYPAT permit tcp any host

eq 80

access-list WEB-SRV-POLICYPAT permit tcp any host

eq 443

nat (outside) 200 access-list WEB-SRV-POLICYPAT

global (outside) 200

As I said already, I would have to test this on some ASA running 8.2 to confirm that both the destination and source translation is applied. Provided that works then the traffic should flow from the user to the main site and to the secondary site and back to the user through the main site again.

- Jouni

[Jouni Forss · Accepted solution]

Or actually,

I am not sure you have mentioned your software level. In that case the NAT configuration would be completely different ofcource. It could actually be done with a single command (although that command would require some objects created for it)

Probably something like this

object network SRV-PUBLIC-MAIN

host 1.1.1.1

object network SRV-PUBLIC-SECONDARY

host 2.2.2.2

object network ANY

subnet 0.0.0.0 0.0.0.0

object network USER-PUBLIC

host 3.3.3.3

same-security-traffic permit intra-interface

nat (outside,outside) source dynamic ANY USER-PUBLIC destination static SRV-PUBLIC-MAIN SRV-PUBLIC-SECONDARY

Would also need to do a quick test for this to confirm it actually works since dont really need to resort to these in my work.

- Jouni

[sebastianvandijk]

Hi Jouni,

We're running 8.3.2 thanks

What i don't understand ;  what does the USER-PUBLIC represent ?

[Jouni Forss]

Hi,

That is a Dynamic PAT public IP address with which all the Web server users will show to the Secondary Site (for return traffic routing). You could perhaps replace it with "interface" parameter also.

Let me know if this works for you.

Please remember to mark a reply as the correct answer if it answered your question.

Feel free to ask more if needed though

- Jouni

[sebastianvandijk]

Hi Jouni,

Awesome, got it working !

Thanks !