I'm trying to get the following system setup - I want a client to get to two different network each has a server with the same IP address
I have an ASA 5520 - ver 9.1(1)
I can get one working - for example The commands for one NAT translation are as follows
object network NET2_SVR_NAT
host 10.10.10.2
object network NET2_SVR_REAL
host 192.168.20.101
object network NET2_CLIENT1_NAT
host 192.168.20.3
object network CLIENT1_REAL
host 192.168.0.60
nat (inside,NET2) source static CLIENT1_REAL NET2_CLIENT1_NAT destination static NET2_SVR_NAT NET2_SVR_REAL net-to-net
However this appears to require a IP address on the NET2 interface ( that is if I put address 192.168.20.1 on NET2 it works)
However without the address present Packet tracer indicates that this address is not required - in that the following output occurs when there is no IP address on the interface. However whilst packet tracing works without an IP - pings do not reach the device
My problem is that I cannot put addresses in the correct sub-net on BOTH interfaces (NET1 and NET2)
Is there a way to achieve this functionality ?
I have seen comments that the firewall needs to know what interface to send it out. That is defined - so if this is true then it appears to be a feature of the ASA firewall - So if it is fixed in a later version then that also
Output of interface config and packet tracer follows
(The packet tracer command full text is
packet-tracer input inside tcp 192.168.0.60 12345 10.10.10.2 502
ciscoasa/sec/actNoFailover# sho run int g0/3
!
interface GigabitEthernet0/3
nameif NET2
security-level 0
no ip address
ciscoasa/sec/actNoFailover#
ciscoasa/sec/actNoFailover# packet-tracer input inside tcp 192.168.0.60 12345 $
Phase: 1
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
nat (inside,NET2) source static CLIENT1_REAL NET2_CLIENT1_NAT destination static NET2_SVR_NAT NET2_SVR_REAL net-to-net
Additional Information:
NAT divert to egress interface NET2
Untranslate 10.10.10.2/502 to 192.168.20.101/502
Phase: 2
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group inside_access_in in interface inside
access-list inside_access_in extended permit ip any any
Additional Information:
Phase: 3
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (inside,NET2) source static CLIENT1_REAL NET2_CLIENT1_NAT destination static NET2_SVR_NAT NET2_SVR_REAL net-to-net
Additional Information:
Static translate 192.168.0.60/12345 to 192.168.20.3/12345
Phase: 4
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
Phase: 5
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Phase: 6
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
nat (inside,NET2) source static CLIENT1_REAL NET2_CLIENT1_NAT destination static NET2_SVR_NAT NET2_SVR_REAL net-to-net
Additional Information:
Phase: 7
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
Phase: 8
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Phase: 9
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 1636, packet dispatched to next module
Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: NET2
output-status: up
output-line-status: up
Action: allow
