ACL needed with simple NAT?

[erik.winberg]

Question about the need for an ACL when using NAT on a 1941 router.

I have a very simple configuration where I NAT all inside traffic to the Internet-facing public IP address assigned by my ISP. It's basically something like this:

interface serial0/0

ip address 1.2.3.4 255.255.255.252
ip nat outside

Interface gi0/0

ip address 192.168.1.1 255.255.255.0

ip nat inside

ip nat inside source list 1 interface serial0/0 overload

access-list 1 permit 192.168.1.0 0.0.0.255

All traffic is from inside to outside, no inbound traffic is needed (except, of course, in response to my outbound initiated traffic). Is an ACL on the outside interface still needed here or will the NAT be sufficient to prevent inbound initiated traffic from accessing any of my inside hosts?

[Julio E. Moisa · Accepted solution]

Hi

only your config is enough.

Also the following link could be useful:

http://www.cisco.com/c/en/us/about/security-center/unicast-reverse-path-forwarding.html

:-)

[Diana Karolina Rojas · Accepted solution]

Hello,

Your configuration ensures that only the hosts on your 192.168.1.1 255.255.255.0 network whose packets enter through the gi0 / 0 Interface can be translated to the outside interface, you do not need anything else.

Regards,

-Remember to rate the useful posts.