NAT from cisco asa interfaces toward mpls sites

[nikmagashi1]

Hi,

I have configured a cisco asa (a virtual one) and there I have 5 internal networks (inside ASA) and then from this asa I have an interface calles MPLS which sends traffic (from and to) mpls sites. Now the question is this: I have configures NAT rules as below:

I also have configured 6 other NAT rules with the same setting but with different destination interface. The question is now, do I have to configure others NAT rules the other way round for example:

Or maybe because I have chose under the direction "Both" so there is no need to configure the contrariwise rule.

Best regards

[Rob Ingram]

@nikmagashi1 no you don't need to create NAT rules the other way around, they are bi-directional.

[Marius Gunnerud]

By default static NAT rules are bi-directional.  Dynamic NAT rules are uni-directional.

So for static NAT as long as you have the "Direction" selected as "Both" then no extra NAT configuration is needed for return traffic.

[MHM Cisco World]

this NAT is wrong, you want NAT the inside to MPLS interface? if yes then you need 
and you can use static NAT only for few IP in INside. 

ASDM Book 2: Cisco ASA Series Firewall ASDM Configuration Guide, 7.7 - NAT Examples and Reference [Cisco ASA 5500-X Series Firewalls] - Cisco

[Marius Gunnerud]

The NAT posted is not incorrect, it is Twice NAT and a valid configuration. But, we can discuss if it is a good idea to use Any source and destination.

[nikmagashi1]

Thanks for the response.

The NAT is actually from mpls sites to lan. The firewall is connected to a l3 switch which connect to ISPs router which then connects the sites. And I did this rule but this is not tested yet so thats why I am asking since I want to be sure it will work. So you mean statis NAT is kind of one-to-one mapping and in this case it wont work since I am trying to translate everything that comes from the mpls interface (which are in this case several sites) to the lan interface which ofc there are plenty of clients?

[MHM Cisco World]

Yes Correct 
static NAT is 1:1
here you need to NATing all INside subnet to MPLS interface 

[nikmagashi1]

And which option would that be? I have Dynamic PAT (Hide) and also only Dynamic.

[MHM Cisco World]

@Marius Gunnerud  provide you prefect answer.

[Marius Gunnerud]

This is where you need to define what you are trying to accomplish. If you are looking to translate all traffic from the MPLS network to the LAN interface change it to "dynamic" or "dynamic hide IP" and then specify the translated source IP you want to use.  You might even want to consider placing this NAT rule in "Auto-NAT" also known as "Section 2".

now if LAN needs to initiate traffic to some servers on the MPLS network that are being translated by this NAT statement, then you need to add static / dynamic NATs for this traffic also.

[nikmagashi1]

Thanks Marius,

Im having some difficulties to understand the way of NAT configuration in this context and I hope you can shed some light here

I will explain a little what I am trying to accomplish. For example mpls sites (several private subnets) will talk with internal subnet (lan) on 172.16.123.0/24. My question is how and am I going to translate, what IP should I use (the interface IP for the lan interface?) when the only thing I need to achieve is communication from one network to the other network, physically separated of course (one network is behind the asa and one is not)

[Marius Gunnerud]

For your scenario, as you describe it, you do not need NAT to establish communication through the ASA.  The only time you would be using NAT is if you have IP address conflict between the LAN and an MPLS site, and of course, if you need to route a private IP over a network where private IP is not routable (for example, the internet).  There are of course other situations where you would use NAT but we will leave them out of the discussion for now.

[MHM Cisco World]

LAN-ASA-MPLS-Sites 

if the ASA can access the Sites then you not need NAT at all. 
the NAT use to 
private-to-public 
private-to-private with limit routing 

[nikmagashi1]

I probably need since I have already configured NAT for the inside networks toward internet. And I decided to use static NAT as Marius said it will work but I have changed and specified the source and destination address. It looks like this:

[MHM Cisco World]

Now I think It clear to me
you have SP interface for both Sites and internet, 
for internet you need PAT (dyanmic NAT)
for Sites you need what we called no-NAT (NAT exemption)
Solved: ASA 9.0 - how to display NAT Exemption - within the ASDM - Cisco Community