NAT on a Stick to and ASA

[vivarock12]

is it posible to translate a Nat on a STICK to an ASA?

[balaji.bandi]

I do not see any issue of deployment method, do you have any failures to deploy?

[Marius Gunnerud]

This is possible so long as you have the command same-security permit intra-interface command configured.  Most commonly, in my experience, this is done for RA VPN users that use a tunnel all configuration and require internet access.

Is there a specific scenario you are having issues with?  If yes, please provide a more detailed description of the issue so we can help you further.

[vivarock12]

Well in this case is for reaching a service.

so what i want to do is the folowing in the outside-mpls interface i have the ip adress 10.10.10.2/30,

but the trafic i need to NAT(10.241.120.0/23) is not to that ip address, i need to NAT to one ip address of 10.10.30.13/32(example). 

because the other side router only knows the 10.10.30.0/24.

so can this be done?

                                                 10.10.10.0/30               172.16.3.0/30

10.10.30.1/29[Core]----[ASA]-.2----------.1-[ISP]-.1-----------.2-[Client]--[Lan X]

                        |

10.241.120.0/23

[Marius Gunnerud]

Does the ASA have an interface in the 10.10.30.0/24 network? 

Where is the source traffic coming from (source IP)? 

So, if I understand correctly, you want to use an IP in the 10.10.10.0/30 as the destination for an IP in the 10.10.30.0/24 network?  If this is the case, this is possible.  Just make sure that the destination network knows how to route back to the source network.

[vivarock12]

Does the ASA have an interface in the 10.10.30.0/24 network?

no, the asa haves a l3 conection to the core, the core has the 10.10.30.x/30, for some reason on the other side they alow the 10.10.30/24.so i have to nat to some op of this segment.

so it is posible besides the fact that the asa does not have that ip directly connected?

and if is posible coud you share and example.

and thank by le way.

[vivarock12 · Accepted solution]

not sure about nat on stick but i end up doing the following:

auto
!
object network NOC
subnet 10.241.120.0 255.255.255.0
nat (inside,Client_wan) dynamic 10.10.30.15
!

manual
object network NOC
subnet 10.241.120.0 255.255.255.0
!
object network NAT-IP
host 10.10.30.15
!
nat(inside,Client_wan) source dynamic NOC NAT-IP
!

it work in both cases.