NAT Complications

[andrewburridge]

Hi Guys, was hoping you could help.  I'm getting myself in a big muddle with regards to NATing, and could do with some clarity.

We have a setup whereby there are 2 firewalls back to back on a 172.22.11.0/24 subnet.  I control one firewall, another company (company B)  the other.  My PIX has its outside interface as 172.22.11.254, and its inside interface as 172.22.255.21.

I'm trying to set up a NAT whereby clients on my inside network can connect to 172.22.11.11 (as this is routable by me) on a specific port, and this will NAT them to the real address 172.31.36.6 on the same port, on the other side of company B's firewall.  Company B are doing the reverse.

I've allowed traffic to come into the firewall's inside interface, and can see it entering.  There is a dynamic NAT mapping any traffic from the inside interface to the outside.

I've set up a static NAT policy rule on the outside interface, taking a source IP of the outside interface (172.22.11.254), a destination of 172.22.11.11, a static translation to 172.31.36.6, and the relevant port translation, but this doesn't work.  Looking at the logs, I can't see anything even attempting to be translated.

I know this is a lot to take in, but any ideas where I'm going wrong?

Thanks for any suggestions.

[Jon Marshall · Accepted solution]

Andrew

I've set up a static NAT policy rule on the outside interface, taking a source IP of the outside interface (172.22.11.254), a destination of 172.22.11.11, a static translation to 172.31.36.6, and the relevant port translation, but this doesn't work.  Looking at the logs, I can't see anything even attempting to be translated.

I'm not sure what you mean by the bit in bold. But from your requirements have you tried -

static (outside,inside) 172.22.11.11 172.31.36.6 netmask 255.255.255.255

Jon

[andrewburridge]

Hi Jon,

That appears to be working now, at least from my end.  I was going through the GUI and ended up applying the NAT the wrong way round by the looks of things.  Lesson learned, alway stick to the CLI!

Thanks,

Andy

[Jon Marshall]

Andy

Couldn't agree more. GUIs are useful sometimes but i never got on with ASDM at all.  I would fire it up and by the time i had worked out what to do i could have configured 3 firewalls by using the CLI

Jon