06-07-2013 07:45 AM - edited 03-11-2019 06:54 PM
I have a situation with some lab instruments that all have the same IP address 192.168.100.1. This is built into firmware and changing it is not possible. So for me to have these instruments connect to specific hosts for managment purposes I need to figure a way to map ( nat ) the 192.168.100.1 address to a different address 192.168.200.1, 192.168.200.2.....etc. Then have that address connect to a specific host addresses 192.168.200.1 -> 192.168.8.1 etc. I have a cisco asa 5500 ( 5505 or 5520 9.1) that I would like to use to route and nat this traffic. Would twice NAT work here or do i have an issue with the single IP in translation table always going to wrong or same instrument?
nat (instr_if, core_if) source static obj-192.168.100.1 instr_nat1 destination static real_host1 real_host1
nat (instr_if, core_if) source static obj-192.168.100.1 instr_nat2 destination static real_host2 real_host2
.
.
.
.
nat (instr_if,core_if) source static obj-192.168.100.1 instr_nat12 destinantion static real_host12 real_host12
06-07-2013 09:46 AM
Hello Matthew,
You can do this with twice Nat but my question is
As long as they live on different interfaces you can perform the NAT rule,
The configuration looks good
Regards
Julio Carvajal
06-07-2013 10:23 AM
The instruments all have a different ethernet network interface if that is what you mean...but if you mean the asa will have a separate interface for each instrument, no that would not be the case.
06-07-2013 12:03 PM
Hello Matthew,
If they are on the same network then how is the traffic going to reach the FW,
The only way that I can see is with U-turn
In this scenario
You will configure each application or host to connect to the other host via a mapped IP address, and this Mapped IP will be set on the ASA,
What is the version of your ASA?
06-07-2013 12:42 PM
Through a layer two switch which the firewall will be connected to.
each instrument has same ip and they would be mapped to a IP that would be different for each connection on the asa then routed to the host via a layer 3 switch, obviously an interface ( core_if ) on the asa is connected to the core ( layer 3 switch )
Version 9.11
06-07-2013 12:46 PM
this might help....
Instrument ---> layer 2 switch --->FW ---> layer 3 switch ---> host ( server )
06-07-2013 02:46 PM
Hello Matthew,
okey so the communication would be from the Instrument behind the firewall to the host (in front of the firewall)
Is that true
06-10-2013 06:34 AM
Actually, yes, I guess you can say that since I am nat the address of the instrument to different IP's to communicate with the host which could be viewed as in front of the firewall. The host IP is its real IP and the instrument IP is Nat'ed to allow a different IP to be assigned since the instrument itself has a hardcoded IP in the firmware and will always be the same for all the instruments (192.168.100.1). Don't ask me why the manufacturer did this, but we need to try to make this work since it can't be changed on the instrument side. There are othe ways around this by attaching a separate router to each instrument and nat-ing an ip that way. But buying and supporting multiple routers is a pain.
06-10-2013 11:43 AM
Hello Matthew,
Okey,
The thing is that the firewall will not be able to differentiate between one IP and the other so it will perform the NAT rule that matches the exact connection,
What I mean by this is that you can set a different NAT policy using the same source with each different destination address,
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide