12-09-2020 07:22 AM
Hello all,
I have a client that wants an ISR 4431 at the edge of the network, with a FPR 2110 behind it. They use to have an ASA at the edge, doing all of the routing and NAT'ing. I have converted the ASA config to the FPR, but now I have the Outside interface facing the ISR, with a private subnet between them (172.23.10.0/24). The FPR can only reach the Internet if I have NAT on the ISR (basic PAT on the ISR, NAT out, NAT in, inside source list 1 int g0/0/1 overload), so it's a double NAT scenario but traffic does reach the Internet. I tested this by attaching a client on an unused port on the FPR, and it is getting Internet access. The big problem is that the old ASA (now the FPR) has NAT statements converting private IPs to certain public IPs on the Outside interface of the FPR, but the Outside interface is now in a private subnet between the FPR and ISR. I was wondering if the FPR will be able to forward the NAT'ed traffic to the private IP interface of the ISR, and the ISR then forwards it to the Internet. I am trying to accomplish this in the easiest way possible without doing a ton of NAT statements on the ISR. By the way, the FPR sees the default route to the Internet. I will post route tables if needed.
12-09-2020 07:29 AM
Since FP do not own Public IP binded, you need to rely on ISR do NAT here i guess.
then if you FP doing NAT, you need to Translate as original so ISR can NAT for you,
is this make sense or misunderstood the requirement ?
12-09-2020 12:28 PM
ok,
if you have one public IP before then the config will be
ASA port-froward from ASA private to ISR private with specific port
ISR port-forward from private to public same port
ASA dynamic from ASA private to ISR private
ISR dynamic from private to public
12-09-2020 01:37 PM
Hello
Just to confirm, your FPR is already natting to an inside global address of 172.23.10.0/x and you are wondering is then the ISR can then NAT its lan subnet (FRP wan subnet) to public routed address and obtain connectivity?
If so then yes it should work, as it just basically double natting your traffic.
12-09-2020 02:01 PM
Paul,
Thanks for your response. Yes, double NAT'ing is working in this scenario, as I have a TEST interface on the FPR with a private IP of 172.24.10.1/24 that has a laptop directly connected, and the laptop can access the Internet. My concern comes in from the NAT statements that were migrated over from the old ASA. Many of those NAT statements translated the inside and DMZ interfaces to public IP addresses since the old ASA was at the edge, but now since the FPR is behind a router, I am wondering if those translated public IPs can get to the ISR private side, and then go out of the ISR to the Internet.
OLD: LAN>>private IP--ASA--public IP>>INTERNET
NEW: LAN>>private IP--FPR--private IP>>(NAT'ed public IPs)>>private IP--ISR--public IP>>INTERNET
12-09-2020 03:17 PM - edited 12-09-2020 03:21 PM
Hello
If those public addresses are owned by the ISP that your ISR is connecting to then it should still work, without double natting them, just need to make sure the ISR rtr knows how to reach them and the isp is indeed advertising them on your behalf and you not try to advertise another ISPs address range.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide