PAT using a Different IP from ASA "Outside" Interface

[johnlloyd_13]

hi,

quick question, does the IP address for doing dynamic PAT has to be in the same subnet as the ASA "outside" interface?

see sample below. we control the routing for the "outside" network which integrates with a partner network.

interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 100.1.1.1 255.255.255.0

object network OBJ-192.168.1.0-24
nat (inside,outside) dynamic 200.1.1.10

[Rob Ingram]

Hi,

Yes that will work. You just need to ensure the upstream router has a route to that IP address/network via the ASA.

HTH

[Ruben Cocheno]

@johnlloyd_13 

you control the egress, so you can set what IP is going to appear on the outside network, using dynamic PAT for different ranges. In fact thata is a very good strategy. I will assume that you have a default route through that interface. 

Youd config looks right.