Outbound PAT based on destination address

[gladecreek]

I have two VPN tunnels to distinct external entities.  Each entity only allows traffic from a specific IP address.  I need to use a single NAT/PAT address for traffic through tunnel 1 and a different NAT/PAT address for traffic through tunnel 2.

Entity 1 expects all user traffic to come from 65.72.34.2

Entity 2 expects all user traffic to come from 65.72.34.3

In ASA 8.2, I would do this with NAT / Global statement pairs, but I can't figure out to do this in 9.4.  Can I use an ACL for outbound PAT?  If so, what would the syntax look like?

[Mohammed al Baqari]

Ypu need to use twice nat in 9.4 to achieve what you are looking for

[gladecreek]

Do you mean by specifying both a source keyword and destination within the same nat statement? If so, where in that statement is the nat’ed address specified? Could you give me an example?

[Ajay Saini · Accepted solution]

Hello,

The syntax looks like below. It will PAT the source network test-src to obj-65.72.34.2 when accessing the remote subnet test-dest

object network obj-65.72.34.2
host 65.72.34.2

nat (inside,outside) source dynamic test-src obj-65.72.34.2 destination static test-dest test-dest

test-src object is your source network that needs to access test-dest object network on remote side

Please note that using this you can only initiate the traffic from src to dest side because we are PATting the source to a single ip address and by logic it will be unidirectional. 

For more NAT on 8.3 onwards:

https://supportforums.cisco.com/t5/security-documents/asa-8-3-upgrade-what-you-need-to-know/ta-p/3127078#toc-hId--1214137034

HTH
AJ

[gladecreek]

Thanks, Ajay.  That's exactly what we needed to get it working.