11-21-2014 02:23 PM - edited 03-11-2019 10:07 PM
I have been presented with a NAT scenario that I'm trying to work though, basically it is a src and dst nat like so:
nat (inside,outside) source static src1-original src1-translated destination static dst1-original dst1-translated
The twist is there are a large number of (random) source nats, over 100 of them, so it then looks like so:
nat (inside,outside) source static src1-original src1-translated destination static dst1-original dst1-translated
nat (inside,outside) source static src2-original src2-translated destination static dst1-original dst1-translated
nat (inside,outside) source static src3-original src3-translated destination static dst1-original dst1-translated
Now the plot thickens... they also have 100+ random dst NATs we need to account for... for an example of 3 servers on each side, that's 9 lines of nat:
nat (inside,outside) source static src1-original src1-translated destination static dst1-original dst1-translated
nat (inside,outside) source static src2-original src2-translated destination static dst1-original dst1-translated
nat (inside,outside) source static src3-original src3-translated destination static dst1-original dst1-translated
nat (inside,outside) source static src1-original src1-translated destination static dst2-original dst2-translated
nat (inside,outside) source static src2-original src2-translated destination static dst2-original dst2-translated
nat (inside,outside) source static src3-original src3-translated destination static dst2-original dst2-translated
nat (inside,outside) source static src1-original src1-translated destination static dst3-original dst3-translated
nat (inside,outside) source static src2-original src2-translated destination static dst3-original dst3-translated
nat (inside,outside) source static src3-original src3-translated destination static dst3-original dst3-translated
If we get up to 100 servers on each side, a static mesh of these NATs gets up to 10000 lines of NAT. Eeek! I've been trying to lab out other ways to do this more effectively but am stumped. Is there a better way to go about this?
Thanks!
Solved! Go to Solution.
11-22-2014 01:26 AM
Hi,
I think the only other possible way to reduce the NAT statements would be to use the object groups in the NAT statements.
Object-group network source
object src1
object src2
object src3
Object-group network destination
object dest1
object dest2
object dest3
nat (inside,outside) source static source source-translated destination static destination-translated destination
Thanks and Regards,
Vibhor Amrodia
11-21-2014 02:43 PM
If I can have it evaluate NAT two different times that could help reduce it to 200 lines if there are 100 servers on each side. The first pass-through does the src translation:
nat (inside,outside) source static src1-original src1-translated destination static dst-subnet-original dst-subnet-original
nat (inside,outside) source static src2-original src2-translated destination static dst-subnet-original dst-subnet-original
nat (inside,outside) source static src3-original src3-translated destination static dst-subnet-original dst-subnet-original
After the source is translated then the second pass-through evaluates does the dst translation:
nat (inside,outside) source static src-subnet-translated src-subnet-translated destination static dst1-original dst1-translated
nat (inside,outside) source static src-subnet-translated src-subnet-translated destination static dst2-original dst2-translated
nat (inside,outside) source static src-subnet-translated src-subnet-translated destination static dst3-original dst3-translated
11-22-2014 01:26 AM
Hi,
I think the only other possible way to reduce the NAT statements would be to use the object groups in the NAT statements.
Object-group network source
object src1
object src2
object src3
Object-group network destination
object dest1
object dest2
object dest3
nat (inside,outside) source static source source-translated destination static destination-translated destination
Thanks and Regards,
Vibhor Amrodia
11-24-2014 08:05 AM
Thank you Vibhor that worked as expected during my testing! Using object-groups if it finds a match on let's say line 43 of the original source, it will go to line 43 for the translated-source object-group. So as long as the original source and translated source line up on the same lines between the two object groups, that works!
Thanks again!
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide