Two Different Static NAT IP's for One Host

[maximtretiakov]

Hello there,

I need to apply two static NAT IP's in different subnets for one host:

                        10.1.10.1 for other clients

                                         |

                                         |                                | 10.1.1.1 for Client1(192.168.1.0/24)

HOST(172.16.1.11) -- PIX515 -- Router3725 --|

                                                                          |  ??? 10.1.2.1 for Client2(192.168.2.0/24)

There is static nat 172.16.1.11<>10.1.1.1 for client1 on Router3725

There is static nat 172.16.1.11<>10.1.10.1 for other clients on PIX515

Is it possible to perform static NAT 172.16.1.11<>10.1.2.1 for client2 either on PIX515 or Router3725?

Thanks

[sylvain.munaut · Accepted solution]

Yes, you can restrict a static nat entry using route maps.

(assuming here than Vlan1 is the interface for client1 subnet and Vlan2 is interface for client2 subnet)

route-map rm_client1

match interface Vlan1

match ip address acl_client1

route-map rm_client2

match interface Vlan2

match ip address acl_client2

ip access-list extended acl_client1

permit ip any 192.168.1.0 0.0.0.255

ip access-list extended acl_client2

permit ip any 192.168.2.0 0.0.0.255

ip nat inside source static 172.16.1.11 10.1.1.1 route-map rm_client1

ip nat inside source static 172.16.1.11 10.1.2.1 route-map rm_client2

[maximtretiakov]

Beautiful!   Thanks a lot!

Client1 and Client2 are accessible through the same interface, could it cause any problem? :

route-map rm_client1

match interface Fa0/0.10

match ip address acl_client1

route-map rm_client2

match interface Fa0/0.10

match ip address acl_client2

...

[sylvain.munaut]

No it should be fine.

You can also probably omit the 'match interface' altogether and just use the 'match ip address'

[maximtretiakov]

Thank you!