cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

811
Views
0
Helpful
5
Replies
Highlighted
Beginner

NAT question for ASA running 8.4(5)

We have a client who is about to hang an ASA off the DMZ of our firewall that is running 8.4(5). That firewall is currently on a different part of our network, and NAT is going to be significantly changed. Now, everything on the clients firewall needs to be NATed on the outside to the same as the internal IP scheme, e.g. like the old "static (inside,outside) 172.16.16.0 172.16.16.0 netm 255.255.255.0" command.

When I look at Cisco's document for NAT conversion (

http://www.cisco.com/en/US/docs/security/asa/asa83/upgrading/migrating.html#wp96828), I don't see any conversion between the two. This isn't a "nat 0" because Internet users will need access to some hosts on the inside of our client's firewall.

Can someone please point me in the right direction? Thanks

Everyone's tags (2)
1 ACCEPTED SOLUTION

Accepted Solutions
Mentor

Re: NAT question for ASA running 8.4(5)

Hi,

Lets assume that the following is true

  • The new ASA has "inside" and "outside" network/interface only
  • The new ASA doesnt have to do ANY NAT from "inside" to "outside" traffic at any situation (your firewall handles this?)

Then you can simply have the ASA with absolutely NO NAT configurations. The ASA with the new software versions 8.3 and above automatically passes all traffic UNNATED through the ASA. We use this on one customer and it works just fine.

Please let me know if the above is the case or if not can think of something else

- Jouni

5 REPLIES 5
Beginner

Re: NAT question for ASA running 8.4(5)

Will the following work:

nat (inside,outside) source static any any       

Mentor

Re: NAT question for ASA running 8.4(5)

Hi,

Lets assume that the following is true

  • The new ASA has "inside" and "outside" network/interface only
  • The new ASA doesnt have to do ANY NAT from "inside" to "outside" traffic at any situation (your firewall handles this?)

Then you can simply have the ASA with absolutely NO NAT configurations. The ASA with the new software versions 8.3 and above automatically passes all traffic UNNATED through the ASA. We use this on one customer and it works just fine.

Please let me know if the above is the case or if not can think of something else

- Jouni

Beginner

Re: NAT question for ASA running 8.4(5)

With the previous versions of firmware, with "nat (inside) 0" and "global outside" commands, you couldn't initiate traffic from the outside to the inside. We will need to do this. So I can simply remove all NAT commands, and it will work fine?

Mentor

NAT question for ASA running 8.4(5)

Hi,

Yes, we have a customer firewall (behind the actual Internet firewall) that has absolutely no NAT configurations. Its only doing access control with ACLs acting as a border between 2 local network segments.

- Jouni

Beginner

NAT question for ASA running 8.4(5)

JouniForss, thanks for your help!