Came across an unusual example of NAT in an ASA recently, difficult to explain but it looked like it was doing a double NAT.
E.g.
Outside IP 222.222.222.222
Mail server 192.168.1.10 (real IP)
In the config there were standard nat rules which translated the destination/outside IP to other IPs (one-many), however the IP it was translated to was for example 172.16.1.10
There was then another nat rule which translated the whole subnet 172.16.1.x to 192.168.1.x, the access list obviously reflected access from the outside to the translated IP 172.16.1.10
The guy which configured it seemed to make out it increased security as it masked the internal IP range, just wondered what other peoples opinions are as it seems pointless to me - the dst and source nat rules surely hide the internal ip scheme anyway??
Thanks in advanced
