Source NAT - ASA

GRANT3779 · ‎04-22-2019

Looking at the below - (This could be any addressing and assume all ACLs are in place etc.. for the traffic flow)

interface Gi0/1
nameif WAN
security-level 100
ip address 10.99.0.1 255.255.255.0

interface Gi0/1
nameif DMZ
security-level 50
ip address 192.168.66.1 255.255.255.0

object network OBJ_VENDOR

subnet 192.168.66.0 255.255.255.0

object network OBJ_HIDE

host 10.44.0.1

nat (dmz,wan) source static OBJ_VENDOR OBJ_HIDE no-proxy-arp

If I have the above NAT, when matching traffic leaves this Firewall, does it leave with a source address of the OBJ_HIDE (10.44.0.1) or does it leave the Firewall with the address of the WAN Interface IP (10.99.0.1) ?

Rob Ingram · ‎04-22-2019

Hi,
Assuming you have no other NAT rule with a higher priority which could potentially nat the traffic behind the wan interface, the traffic from the 192.168.66.0/24 network should be natted with 10.44.0.1.

HTH