NAT question for ASA running 8.4(5)

[baskervi]

We have a client who is about to hang an ASA off the DMZ of our firewall that is running 8.4(5). That firewall is currently on a different part of our network, and NAT is going to be significantly changed. Now, everything on the clients firewall needs to be NATed on the outside to the same as the internal IP scheme, e.g. like the old "static (inside,outside) 172.16.16.0 172.16.16.0 netm 255.255.255.0" command.

When I look at Cisco's document for NAT conversion (

http://www.cisco.com/en/US/docs/security/asa/asa83/upgrading/migrating.html#wp96828), I don't see any conversion between the two. This isn't a "nat 0" because Internet users will need access to some hosts on the inside of our client's firewall.

Can someone please point me in the right direction? Thanks

[baskervi]

Will the following work:

nat (inside,outside) source static any any       

[Jouni Forss · Accepted solution]

Hi,

Lets assume that the following is true

• The new ASA has "inside" and "outside" network/interface only
• The new ASA doesnt have to do ANY NAT from "inside" to "outside" traffic at any situation (your firewall handles this?)

Then you can simply have the ASA with absolutely NO NAT configurations. The ASA with the new software versions 8.3 and above automatically passes all traffic UNNATED through the ASA. We use this on one customer and it works just fine.

Please let me know if the above is the case or if not can think of something else

- Jouni

[baskervi]

With the previous versions of firmware, with "nat (inside) 0" and "global outside" commands, you couldn't initiate traffic from the outside to the inside. We will need to do this. So I can simply remove all NAT commands, and it will work fine?

[Jouni Forss]

Hi,

Yes, we have a customer firewall (behind the actual Internet firewall) that has absolutely no NAT configurations. Its only doing access control with ACLs acting as a border between 2 local network segments.

- Jouni

[baskervi]

JouniForss, thanks for your help!