Question about NAT protocol

[SuperSwaggy567]

Hi all,

I have a question similar to another I asked previously. I'm wondering what strategy would be used to simulate traffic flowing through an ISP router in packet tracer. Both ASAs have dynamic NAT enabled and can ping each other as they have routes of last resort configured. However, if you attempt to ping something behind an ASA from a host behind an opposite ASA how would the ISP router know to forward it to the corresponding ASA interface? The ISP router has no routes configured to any network behind the ASAs as those are meant to be private.

[paul driver]

Hello
With dynamic/static NAT/PAT matching the internal hidden hosts to external public addresses would allow you to reach the internal hosts. 

NAT "hides" the internal network- so you would need to ping these public natted addresses from either ASA network.

[SuperSwaggy567]

Does this mean that you can use NAT to change the destination IP address when it leave the ASA? 

For ex, when the packet reaches ASA A and leaves on the outbound int the srs ip is changed because of my NAT config. However the dest address is for a private ip on network B. In order for the ISP router to know where to send it, ASA A needs to be configured to translate private dest ip addresses for network B to ASA b’s public interface?

[balaji.bandi]

It all depends on the requirement destination or source nat.

you looking to ping only behind ASA devices is any other application you looking to access.

I general condition like to people connected different ISP ( Like Branch to head office connection, they do VPN, so Internal IP address can be access using VPN, not via NAT of external IP as most use case)

if your requirement is different please explain more.

[paul driver]

Hello
Hello
The hidden network isn’t usually routable so you need either ping the other asa public natted address or you could also implement a feature called twice nat at either asa which would then translate both the source/destination addressing of that traffic - as such you could then say initiate a ping from to the hidden network to the other asas public address and both the source (private) and destination address (public) would be translated.

[Richard Burts]

If I am understanding the original post correctly there is a private network A behind ASA A and a private network B behind ASA B. The question is how would a host in network A be able to ping a host in network B. If that understanding is not correct then please provide clarification.

If the ASAs are performing traditional dynamic nat (no static nat configured) then the answer is that hosts in network A will NOT be able to ping hosts in network B.

If you think about the operation of traditional dynamic nat when traffic originated from inside is sent outside the translation creates an entry in the translation table that allows a response to be received and to be forwarded to the correct inside host. But if a packet is received by the ASA that was originated from the outside network then there is no entry that allows access to the inside host. And that is essentially what this question is talking about.

Think about it from the perspective of ASA B. It receives a ping request on its outside interface that originated from network A (and was translated so that the source address is a public IP). So it receives a packet from outside (with a public IP source address) attempting to access an address on the inside. But there is no entry for the inside host in the translation table. So the ping request can not be forwarded to the inside.

If you want hosts in network A to be able to access hosts in network B then the best way to do that would be to configure a site to site VPN between ASA A and ASA B. The other alternative would be to have a static nat on ASA B for the inside address that you want to ping from network A.