Question about NAT and two Internets (default routes)

[adambaack]

Here is my current setup

* main location with Firepower 2100 and Internet with DMZ/Servers.  Default route for all networks goes to this firewall.

* new location with Firepower 2100 and Internet with DMZ.

Trying to setup a NAT from a DMZ IP Address to an Inside Address.  I followed how our main location is setup for an Inside NAT and setup like this:

Type: Auto NAT/Static

Interfaces: Source-Inside , Destination-Outside

Original Source: inside-server-ip

Translated Source: dmz-server-ip

Everything else is untouched.  Only problem is it's not working... I troubleshot it from an outside laptop and the traffic gets to the inside server fine but the source IP is the laptop's real IP and so when the server tries to reply to the laptop it goes out our main firewall connection since the default route for all Internet is there.

Some reason I can't think this through... but I need the traffic the server sees to be the interface IP on the Firepower and not the real IP so it will route it back to the other location firewall and out that Internet.

[Marius Gunnerud]

I didn't quite follow how your setup is.  Is the new site a seperate Firepower 2100 from what is installed at main location?

so you want traffic to flow somthing like the following?

server --> main site FP2100 --> new site FP2100 --> internet

The only way I can think of to make this work is to NAT internet traffic to a private IP on the new site FP2100 to an IP that is routed only toward the new FP2100. Then let NAT do the work.  

So you would need to configure twice NAT and not just regular auto-NAT

[adambaack]

Sorry... hard to explain the new setup. Yes, we have a separate Firepower 2100 pair at a different location on our network. Currently we are in a hub/spoke type network with all locations going through HQ and out the Internet here. We just got the Firepower + Internet at another location on network that I wanted to test out hosting some services off of it.

Currently, the traffic flow for this specific server I'm testing is looking like this:

Incoming: Internet --> new site Firepower --> HQ Server Network --> Server
Reply: Server --> HQ Server Network --> HQ Firepower --> Internet

So reply traffic is going out the wrong Internet trying to respond to my request. A packet capture shows the Internet IP as the source and Server IP as destination. Need the source IP to show as the new site Firepower so traffic is routed properly. Like this:

Incoming: Internet --> new site Firepower --> HQ Server Network --> Server
Reply: Server --> HQ Server Network --> new site Firepower --> Internet

Thanks.

[denilson.mota]

If you can do a quick draft of your current setup so I can see how your traffic flows. apparently it seems a reverse route problem. also check what is the default routes for the HQ server.

[Marius Gunnerud]

The only way to make this work correctly is to NAT the IPs that come from the internet to an IP you have routed to the new site Firepower.  for example:

Internet --> new site Firepower --> NAT source to 10.1.1.1 --> HQ Server network --> Server

Server --> HQ server network --> new site Firepower --> NAT destination back to original --> Internet

This way the default route at the HQ network will not cause asynchronous routing.

So your NAT statement at the new site Firepower should look something like this:

Manual NAT Rule

Static

Source Zone - HQ Network

Destination Zone - Outside

Original source - Server IP

Translated Source - New site Firepower public IP interface (or any other public IP routed towards the new site Firepower)

Original destination - 10.1.1.1 (or any other IP that you specify to be used specifically for this traffic)

Translated destination - any

Just be sure that 10.1.1.1 or whatever IP you use for this is routed towards the new site Firepower.

[adambaack]

Hey Marius,

I think that worked. I set the translated source as the 'Inside Interface' and now the server is seeing the return traffic as the Firepower and not the Internet IP Address.

Would this be recommended against, however? NATing an outside IP all the way to the Inside interface? From a security perspective I could see some concern.

Thank you.

[Marius Gunnerud]

So you translated the IP of PCs on the internet to the inside interface of the FTD?  This I would consider a security risk, if my understanding is correct.  I would rather you find an IP that is not in use in your network and use that instead. Then it is easier to restrict what that IP has access to further inside the network.

But that being said, you should also be restricting the ports that internet clients are able to access the server on.  for example, if this is a web server be sure to have access control policy rule only allowing port tcp/80 and/or tcp/443 to that specific server and deny access to all others.

[adambaack]

Correct, only when they are accessing the inside server. Can I NAT to an unused IP on the inside network if my Inside Interface is on a /30 subnet?

And yes, it's being restricted to allowing a single port on the Internet from coming through. It's for video streaming so TCP/1935.

Thanks.

[Marius Gunnerud]

Yes, you can NAT to an unused IP as long as all routing in that IP goes towards the interface that is in the NAT statement.  Proxy ARP will handle the rest.  But for this to work routing MUST be in place.

[denilson.mota]

Type: Auto NAT/Static
Try this setup and make sure u are in the correct interface name and also enable the ACL for this network, in the NAT section don't specify any port leave blank.

Type: NAT/Static
Interfaces: Source-Inside , Destination-Outside ---->mean the inside network will NAT to outside network.
Original Source: dmz-server-ip
Translated Source: inside-server-ip

Your dmz server ip is natted to outside ip so people can connect trough internet. then:
internet ip---->dmz server ip, then:
dmz server ip--->inside server ip
reverse route: inside--->dmz--->internet
If you have different interfaces like inside,outside,dmz and etc...