Need help ASA NAT

[Greg Bhullar]

Hi,I need help
I have internal Network (inside)
192.168.1.1
192.168.1.2
192.168.1.3
192.168.1.19
192.168.1.89And I want it to nat to external ip --- range 71.1.1.1 /25 (outside)
71.1.1.1
71.1.1.2
71.1.1.3
71.1.1.4
71.1.1.5Q1) What is the best way to nat it on the asa b
static (inside,outside) 71.1.1.1 192.168.1.1 netmask 255.255.255.255and
static (outside, inside) 192.168.1.1 71.1.1.1 netmask 255.255.255.255Thanks in advance]static (inside,outside) 71.1.1.1 192.168.1.1 netmask 255.255.255.255
static (inside,outside) 71.1.1.2 192.168.1.2 netmask 255.255.255.255
static (inside,outside) 71.1.1.89 192.168.1.3 netmask 255.255.255.255or
Q2) should i do like this
static (outside, inside) 192.168.1.0 71.1.1.0 netmask 255.255.255.128Q3)which interface should I apply ?
[b]Q4) What is the difference between :

Hi,

I need help
I have internal Network (inside)
192.168.1.1
192.168.1.2
192.168.1.3
192.168.1.19
192.168.1.89

And I want it to nat to external ip --- range 71.1.1.1 /25 (outside)
71.1.1.1
71.1.1.2
71.1.1.3
71.1.1.4
71.1.1.5

Q1) What is the best way to nat it on the asa

static (inside,outside) 71.1.1.1 192.168.1.1 netmask 255.255.255.255
static (inside,outside) 71.1.1.2 192.168.1.2 netmask 255.255.255.255
static (inside,outside) 71.1.1.89 192.168.1.3 netmask 255.255.255.255

or
Q2) should i do like this
static (outside, inside) 192.168.1.0 71.1.1.0 netmask 255.255.255.128

Q3)which interface should I apply ?

Q4) What is the difference between :
static (inside,outside) 71.1.1.1 192.168.1.1 netmask 255.255.255.255

and
static (outside, inside) 192.168.1.1 71.1.1.1 netmask 255.255.255.255

Thanks in advance

[varrao · Accepted solution]

Hi Greg,

This is the correct way to nat:

static (inside,outside) 71.1.1.1 192.168.1.1 netmask 255.255.255.255

static (inside,outside) 71.1.1.2 192.168.1.2 netmask 255.255.255.255

static (inside,outside) 71.1.1.89 192.168.1.3 netmask 255.255.255.255

This is called one to one nat.

This is Destination nat:

static (outside, inside) 192.168.1.1 71.1.1.1 netmask 255.255.255.255

which means if you are fgoing from inside to outside, and if a request comes for 192.168.1.1 it should be translated to

71.1.1.1, which is not what you want.

Hope this helps,

Thanks,

Varun

[Greg Bhullar]

Thanks for explaining