Question about PAT on ASA

[Terence Lockette]

Hello all,

We currently have a set up where we're natting any and all networks to a range of public IP addresses.  We currently have a /24 of public IP space in which 123 of these addresses are used for dynamic NAT.  I want to reserve some of these addresses by creating a network object for each internal network that needs access to the Internet and then dynamically NAT it to a single IP of our public space.  We currently have around 15 internal networks so we could save a lot of public addresses with this solution.  I have tested it and it seems to work; however, my test was in a very small lab environment.  My question is will this type of set up have any drawbacks in a real production environment?  Most of our networks are either a /24, /23, /22, and we have a single /21 network.  Your feedback is valuable to this scenario.  Thanks in advance!

Regards,

Terence

[Akshay Rastogi · Accepted solution]

Hi Terence,

This would work for sure in production as well. However if the internal network is big and makes lot of connections then  use pat-pool or range of mapped ip for the internal network so that internal network doesn't run out of mapped ip/port(pat-pool exhaust).

please use to link below to implement the same :

http://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/nat_objects.html#pgfId-1455942

Hope it helps.

Regards,

Akshay Rastogi

Remember to rate helpful posts.

[Terence Lockette]

Thanks for your response Akshay,

It seem to test very well in my lab environment so I'm thinking of adding a PAT pool range for each internal network if I go forward with this.  Thanks again!

Regards,

Terence