how to Configure Hide NAT on ASA firewall

[shivaram840]

Hi Friends, 

I am facing a big problem to establish a tunnel between two sites ,

My Office Network is 10.210.23.0/24

My Customer Network uses 10.0.0.0/8 , customer has proposed to make a tunnel between these two sites.

My Office firewall is ASA 5520 IOS 8.2

My customer Firewall is Checkpoint FW-1 (NGX) 6.1

if i make a tunnel between these two sites , here Network conflict occurs ,

my client is suggested to do Hide NAT on ASA ('client mail is Since we  also uses the 10.210.*.* network, can you please NAT your traffic behind an Hide NAT and provide us the IP.)

How to overcome this isse ? we need access from both ends ?

Thanks,

Shiva

[shivaram840]

please help me out friends

[Dina Odeh]

Hi Shiva, 

First you need to NAT your internal network the 10.210.23.0/24 to another subnet only when it communicated with the remote network. 

I mean you can create a NAT statement on ASA that say, please NAT the 10.21.23.0/24 to 192.168.33.0/24 for example when it communicate with 10.0.0.0/8 

This can be done as follow: 

1- create an ACL on ASA : 

access-list vpn permit ip 10.210.23.0 255.25.255.0 10.0.0.0 255.0.0.0 

2- Add a policy static NAT: 

static ( in, out) 192.168.33.0 access-list vpn 

[shivaram840]

Hi Dina,

Thanks for your reply.

successfully i have configured policy NAT.able to ping from both ends using NATed IPs

but client is facing some issues while accesing the servers with port.

for example Client is able to ping MY side IP ( 10.210.23.233 and NATted IP is 192.168.33.233) but when he was trying access the 192.168.33.233:7777 (10.210.23.233:7777). they are unable to access the network

we are getting some error while accessing like

"Portmap Translation Creation Failed'

please find the attachment, please help me about this one.

[Peter Koltl]

The error messages come from ping packets to 10.4.56.10 and not related to TCP/7777 traffic. 10.4.56.10 seems to be routed incorrectly to internal zone.

[shivaram840]

Hi Peter,

Thanks for your reply .

we are able to ping both sides but we we are accessing using port (192.168.200.233:7777) 

we are facing issue , not able to connect.

[Peter Koltl]

https://supportforums.cisco.com/discussion/12940211/vpn-routing-issue

[shivaram840]

Hi Dina,

Thank you so much for your suggestion 

but on the remote side which network should i give to them ? 192.168.33.0/24 ?

 and we need two way communication ?

[Dina Odeh · Accepted solution]

Yes you should give them the 192.168.33.0/24 subnet 

You will have two way communication. Issue will only seen if you have the 10.210.23.0/24 subnet on other side, and here issue will seen only with this subnet not all of them. 

[shivaram840]

Hi Dina, 

other side 10.210.23.0/24 network they are using. but when i give 192.168.33.0/24 network 

for exam if they wanted to hit 10.210.23.100 server in my premises, how they will access this server ?

using 192.168.33.0/24 network ?

 how firewall identifies the 10.210.23.100 if they hit 192.168.33.100 ?

we need to do static NAT for each server ?

Thanks,

Shiva 

[Dina Odeh]

Hi, 

No. As per config we agree on previously:

1- create an ACL on ASA : 

access-list vpn permit ip 10.210.23.0 255.25.255.0 10.0.0.0 255.0.0.0 

2- Add a policy static NAT: 

static ( in, out) 192.168.33.0 access-list vpn 

Server 10.210.23.100 will be accessed by IP 192.168.33.100 

Server 10.210.23.33 will be accessed by IP 192.168.33.33 

and so on.... 

[shivaram840]

Thank you so much dina,

but here i have a small query ,which is 

if i hit 192.168.33.100 to reach the server 10.210.23.100 ?

by default or shall i do one to one NAT (static nat )