01-24-2013 10:51 PM - edited 02-21-2020 04:49 AM
We have a client who is about to hang an ASA off the DMZ of our firewall that is running 8.4(5). That firewall is currently on a different part of our network, and NAT is going to be significantly changed. Now, everything on the clients firewall needs to be NATed on the outside to the same as the internal IP scheme, e.g. like the old "static (inside,outside) 172.16.16.0 172.16.16.0 netm 255.255.255.0" command.
When I look at Cisco's document for NAT conversion (
http://www.cisco.com/en/US/docs/security/asa/asa83/upgrading/migrating.html#wp96828), I don't see any conversion between the two. This isn't a "nat 0" because Internet users will need access to some hosts on the inside of our client's firewall.
Can someone please point me in the right direction? Thanks
Solved! Go to Solution.
01-25-2013 01:12 PM
Hi,
Lets assume that the following is true
Then you can simply have the ASA with absolutely NO NAT configurations. The ASA with the new software versions 8.3 and above automatically passes all traffic UNNATED through the ASA. We use this on one customer and it works just fine.
Please let me know if the above is the case or if not can think of something else
- Jouni
01-24-2013 11:01 PM
Will the following work:
nat (inside,outside) source static any any
01-25-2013 01:12 PM
Hi,
Lets assume that the following is true
Then you can simply have the ASA with absolutely NO NAT configurations. The ASA with the new software versions 8.3 and above automatically passes all traffic UNNATED through the ASA. We use this on one customer and it works just fine.
Please let me know if the above is the case or if not can think of something else
- Jouni
01-25-2013 03:09 PM
With the previous versions of firmware, with "nat (inside) 0" and "global outside" commands, you couldn't initiate traffic from the outside to the inside. We will need to do this. So I can simply remove all NAT commands, and it will work fine?
01-25-2013 05:35 PM
Hi,
Yes, we have a customer firewall (behind the actual Internet firewall) that has absolutely no NAT configurations. Its only doing access control with ACLs acting as a border between 2 local network segments.
- Jouni
01-26-2013 06:25 AM
JouniForss, thanks for your help!
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide