NAT question for a VPN

[ALIAOF_]

If I have a local network or 10.1.1.0/24 and I want to NAT all the hosts to 192.168.1.0/24.  I don't really want to create the network object for every single host as that is just to much.  I just wanted to confirm by creating two objects and then natting them should setup a one to one NAT right?

object network obj-10.1.1.0

subnet 10.1.1.0 255.255.255.0

!

object network obj-192.168.1.0

subnet 192.168.1.0 255.255.255.0

!

nat (inside,outside) source static obj-10.1.1.0 obj-192.168.1.0 destination statick "remote" "remote"

Now when the remote network needs to access the hosts on 10.1.1.0/24 network they should just be able to access as follows?

10.1.1.1 will map to 192.168.1.1

10.1.1.2 will map to 192.168.1.2

10.1.1.3 will map to 192.168.1.3

and so on....?

[Jouni Forss · Accepted solution]

Hi,

You are correct. The configuration you posted will work just like that.

Souce address compared to the Destination address will match eachother regarding the last part of the IP address. Also naturally there will be no difference on the real and "mapped" ports of connections.

EDIT: Wrote the above really stupidly. I mean the Original and Mapped address will match eachother refarding the last part of the IP address. NOT source and destination like above.

- Jouni

[Jouni Forss · Accepted solution]

Also,

A test on my home ASA

Configuration

object network LAN

subnet 10.0.0.0 255.255.255.0

object network REMOTE

subnet 10.0.1.0 255.255.255.0

object network LAN-NAT

subnet 10.0.100.0 255.255.255.0

nat (LAN,WAN) source static LAN LAN-NAT destination static REMOTE REMOTE

LAN to REMOTE

ASA(config)# packet-tracer input LAN tcp 10.0.0.10 1025 10.0.1.1 80

Phase: 3

Type: NAT

Subtype:

Result: ALLOW

Config:

nat (LAN,WAN) source static LAN LAN-NAT destination static REMOTE REMOTE

Additional Information:

Static translate 10.0.0.10/1025 to 10.0.100.10/1025

REMOTE TO LAN

ASA(config)# packet-tracer input WAN tcp 10.0.1.100 1025 10.0.100.10 80

Phase: 1

Type: UN-NAT

Subtype: static

Result: ALLOW

Config:

nat (LAN,WAN) source static LAN LAN-NAT destination static REMOTE REMOTE

Additional Information:

NAT divert to egress interface LAN

Untranslate 10.0.100.10/80 to 10.0.0.10/80

- Jouni

[ALIAOF_]

Awesome thanks so much.