NAT help

[mjsully]

Have an ASA5520 running 9.17 code. It currently has the following NAT statement in it:

object network obj-10.10.1.1
 nat (inside,DMZ) static 172.252.252.252

I have a need where I need this 10.10.1.1 host to be able to communicate with 2 specific hosts on the DMZ, but NOT get translated when doing so. The 2 hosts have IP's of 192.168.1.1 and 192.168.1.2. Not sure the config or type of NAT to do this nor am I sure the order of operations on which will take place first. I only want it not to translate going to the 2 hosts, the rest of the time I want it to keep getting translated to 172.252.252.252. Help appreciated. thank you

[Francesco Molino]

Hi 

You can create 2 nat exemption for that. 

Object network obj-192.168.1.1

  Host 192.168.1.1

!

Object network obj-192.168.1.2

  Host 192.168.1.2

!

nat (Inside,DMZ) source static obj-10.10.1.1 obj-10.10.1.1 destination static obj-192.168.1.1 obj-192.168.1.1 no-proxy-arp route-lookup

!

nat (Inside,DMZ) source static obj-10.10.1.1 obj-10.10.1.1 destination static obj-192.168.1.2 obj-192.168.1.2 no-proxy-arp route-lookup

hope that helps. 

Thanks 

PS: Please don't forget to rate and mark as correct answer if this answered your question

[mjsully]

Thank you. That helps. One more follow up, I can do that same NAT and use a source subnet also, right? meaning if I decided I wanted everything on 10.10.1.0/24 subnet to NOT get translated when talking to 192.168.1.1 and 192.168.1.2, could I just change the statements to the following:

object network obj-10.1.1.0
 subnet 10.10.1.0 255.255.255.0

nat (Inside,DMZ) source static obj-10.10.1.0 obj-10.10.1.0 destination static obj-192.168.1.1 obj-192.168.1.1 no-proxy-arp route-lookup

nat (Inside,DMZ) source static obj-10.10.1.0 obj-10.10.1.0 destination static obj-192.168.1.2 obj-192.168.1.2 no-proxy-arp route-lookup

[Francesco Molino]

Hi 

Yes you can.

Thanks 

PS: Please don't forget to rate and mark as correct answer if this answered your question

[B. BELHADJ]

And this is what we call Identity NAT. Please further informations on this link: http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/nat_bypassing.html