NAT Group of IPADDRs

[joshwa]

I am wanting to give a group of IPADDRs there own Public IPADDRs. I have around 75 /26 address that are in every sites scope that I will need to set this for. Typically I place the guest traffic on their own /16 subnet and create on object network GUEST_PUB_IPADDR, subnet x.x.x.x /16, nat (inside,outside) dynamic P.P.P.P.

I would need to create 75 of these per site. Is there another way to NAT this group? 

[Marius Gunnerud]

If I understand correctly you are looking for another way to NAT 75 addresses / subnets per site?

You could group them into an object group and use.

object-group network NAT_Grp

 network-object 10.1.1.0 255.255.255.0

 network-object 10.1.2.0 255.255.255.0

 network-object 10.1.3.0 255.255.255.0

 nat (inside,oustide) after-auto source dynamic NAT_Grp interface

[joshwa]

I am NATing these IPADDR to a separate, specific IPADDR just for the Guest traffic. All other traffic have a NAT to get out using a NAT statement to a Public IPADDR P.P.P.20, for the corp user. Guest would go out P.P.P.25.



I have to apply the NAT to only this group. 



I need NAT_Grp to have Public IPADDR of P.P.P.25

object-group network NAT_Grp

 network-object 10.1.1.0 255.255.255.0

 network-object 10.1.2.0 255.255.255.0

 network-object 10.1.3.0 255.255.255.0





That that I have currently is:

nat (inside,outside) after-auto source dynamic any pat-pool DEFAULT_PUBLIC



I currently have below but it is not working. I think the above is taking precedence. 

nat (inside,outside) after-auto source dynamic NAT_Grp pat-pool GUEST_WIFI_PUBLIC

[Marius Gunnerud]

Is the NAT statement for NAT_Grp object group below the other NAT statement? If yes then this is why it is not being matched.  You need to move the statement above that statement...as follows:

nat (inside,outside) after-auto source dynamic NAT_Grp pat-pool GUEST_WIFI_PUBLIC

nat (inside,outside) after-auto source dynamic any pat-pool DEFAULT_PUBLIC

In the second statement you are matching any IP so if the NAT_Grp NAT is below it will never be hit.

[joshwa]

How can I move the NAT statement without affecting current production? 

I am assuming I will need to remove the any NAT statement?

[venkat_n7]

are you talking about each individual remote sites that should be configured with NAT from private to public IP?

[joshwa]

Each site will be using 1 Public IPADDR allocated for Guest that will be seen on the internet. I would like to move the Guest traffic to its own because in the past I had a Guest user get the Public IPADDR Blacklisted. It was tired to the production network Public IPADDR and had to move many services off to another IPADDR to get things working.

[venkat_n7]

If that was the case and your are routing guest network directly to connected isp, you should be doing those NAT statements for each site. I think this is manual process to do for each site. i know doing this for 75 sites will take time but i think there is no other option. 

i recommend to use scripting to do this, as all remote site's firewalls are reachable to you. This is simple job but takes time to do it.

Note: above process depends on the way you route the traffic from remote sites. 

[Marius Gunnerud]

If you are using the same public IP for all the guest networks then you just need to create one guest object-group and place all the relevant subnets into that group.  Then configure NAT for that object group.  A little work that needs to be done, but once it is in place any new guest network would just need to be added to that object group and they are good to go..NAT wise.

[joshwa · Accepted solution]

How would that look code wise. Is the above configurations correct that I had previously?

[Marius Gunnerud]

The code I posted earlier will do the trick if you are using the same public IP for all guest networks.