Static NAT with one real IP and 2 public IPs on 2 ASAs

[vishnureddy1979]

I have a server with 10.210.1.229 which is configured for static NAT on the old firewall. This firewall has several VPN connections that terminate on this firewall. As we are transitioning the VPNs to terminate on the new Firewall 5525x Can I create a static nat on for this server with another public IP as the routing has been taken care off. Could this be done without any conflicts? Has anyone has accomplished this so for? Thanks in advance.

 XX.XXX.XX.203 - I have to configure this in the new Firewall

 XX.XXX.XX.229 - This is already mapped to real server in old firewall 

Thanks,

Vishnu

[Philip D'Ath]

Is this static NAT only used by VPN users, or the global Internet?

[vishnureddy1979]

This static NAT is only used by VPN users.

[Richard Burts]

If you configure the second static NAT on the new firewall how would you manage which address the user on the VPN connection would use to access the server? I can see that packets from the outside if they use the proper IP address for the server will get to the server ok. But I do not see how you would handle packets that are responses from the server. How do you determine to which firewall to send the response? Overall I see this approach as quite problematic.

HTH

Rick

[vishnureddy1979]

Each customer is connecting to our site is using the peer IP address through Site to Site VPN. My understanding was that once the new customers can terminate VPN connection on to the new Firewall using its peer address, as ASA does the stateful transaction it knows how to forward the return traffic to the client(response from the server). For establishing the session, it has to be initiated from the customer site due to security reasons through Tech support software. 

I was thinking whether i can create a static nat for the same server from New ASA using different public IP and same real IP(same server) as there is already a static entry in the old firewall. Will this cause any network issues? 

[Richard Burts · Accepted solution]

If this is done as part of site to site VPN and if the static NAT is part of the site to site configuration then that would solve the issue that I raised about how the server would know to which ASA to send response traffic.

HTH

Rick

[vishnureddy1979]

Thanks Richard.

I will gohead and try this and will update here once completed.