NAT from inside to outside and dmz

[lcaruso]

In 8.3 and beyond, how do I NAT to both the outside and the dmz?

When I try this it complains

object network inside-network

nat (inside, any) dynamic interface

[csaxena · Accepted solution]

Hi,

Please try the following commands and let me know if it resolves the issue.

object network  inside-network

   subnet 0.0.0.0 0.0.0.0

   nat (inside,outside) dynamic interface

object network  inside-network_1

   subnet 0.0.0.0 0.0.0.0

   nat (inside,dmz) dynamic interface

Hope this helps. Please reply if you need further assistance.

Regards,

Chirag

P.S.: Please mark this thread as answered if you feel your query is answered. Do.rate helpful posts.

[lcaruso]

Thanks for your reply.

I can see that would work, yet it looks awkward.

It's hard to imagine the designers of the new NAT would have it that way, so maybe I'm not asking the right question.

Here is my scenario:

A. these are still not correct or optimally implemented:

     dmz hosts need to contact inside hosts

     inside hosts need to contact dmz hosts

B. these are done and have been tested:

inside hosts need to contact outside hosts

object network inside-network
 nat (inside,outside) dynamic interface

dmz hosts need to contact outside hosts

object network dmz-network
 nat (dmz,outside) dynamic interface

outside hosts need to contact dmz hosts

object network server1
 nat (dmz,outside) static 24.a.b.c

outside hosts need to contact inside hosts

object network server2
 nat (inside,outside) static 24.x.y.z

can you show my a more elegant way to use 8.3 nat to accomplish my scenario?

[lcaruso]

My follow up question is for part A do I need to change the addresses at all?

Should I just be doing identity nat?

How do I decide when I need to hide private addresses from each other?

[csaxena · Accepted solution]

Hi,

Here is a very good  dcument that will elaborate on the pre 8.3 and new 8.3 nat statements.

https://supportforums.cisco.com/docs/DOC-9129

This is should help if you are familiar with pre-8.3 NAT.

The following link gives you details of nat statements in 8.3

http://www.cisco.com/en/US/docs/security/asa/asa83/upgrading/migrating.html#wp83968

Hope this helps.

Regards,

Chirag

P.S.: Please mark this thread as answered if you feel your query is answered. Do.rate helpful posts.

[csaxena · Accepted solution]

Yes, identity nat will help.

You can configure nat(inside,dmz) source static obj-inside obj-inside destination static obj-dmz obj-dmz

Also, you will require access-list in inward direction on dmz interface to allow traffic to inside network.

Regards,
Chirag

[lcaruso]

thanks. this is what I used

nat (inside,dmz) source static any any

[csaxena]

Gr8

I'm glad the issue is resolved.