nat cisco asa ver 9

Hi
I want to configure Nat for only one internal ip address to browse the internet.
Ip address is 192.168.1.100
Please assist with config.

Interface 0/0
LAN
192.168.1.1 255.255.255.0
Interface 0/1
External
196.46.5.5 255.255.255.252
ciscosuppAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

InteraXCommented:
Hi there.

Sorry, but your question is a little vague.

Are you looking to perform a static NAT for just this host to an external IP? Are there any other hosts that will need to access the internet?

I would recommend a dynamic NAT and then use ACLs to block hosts that do not need internet access.
0
ciscosuppAuthor Commented:
yes I only want one host to access internet via nat as the other hosts are using proxy servers
0
InteraXCommented:
So firstly, setup a dynamic NAt for everything on the inside.

nat (inside,outside) source dynamic 192.168.1.0 255.255.255.0 interface

Then create an ACL for the inside interface

access-list inside_in extended permit tcp host 192.168.1.100 any eq 21
access-list inside_in extended permit tcp host 192.168.1.100 any eq 80
access-list inside_in extended permit tcp host 192.168.1.100 any eq 443
access-list inside_in extended deny ip any4 any4

Then apply this to the inside interface.

access-group inside_in in interface inside

The above will allow FTP and standard web browsing from the IP 192.168.1.100.
0
The IT Degree for Career Advancement

Earn your B.S. in Network Operations and Security and become a network and IT security expert. This WGU degree program curriculum was designed with tech-savvy, self-motivated students in mind – allowing you to use your technical expertise, to address real-world business problems.

Pete LongTechnical ConsultantCommented:
Don't forget to allow TCP Port 53 (DNS) or web browsing will fail :)

PL
0
ciscosuppAuthor Commented:
Okay thanks its working perfect my last question is
Would any

nat (inside,outside) source dynamic any interface

 Mean any range is allowed and what does interface mean please advice I just want to understand the command
0
InteraXCommented:
nat (inside,outside) source dynamic 192.168.1.0 255.255.255.0 interface

The above says translate the source address anything arriving on the inside interface and leaving by the outside interface from subnet 192.168.1.0/24 to the outside interface address.

nat (inside,outside) source dynamic any interface

The above says translate the source address anything arriving on the inside interface and leaving by the outside interface from anywhere to the outside interface address.

The keywords any, host and interface have special meanings in the Cisco world. When you move on to using object groups, you cannot use any of the reserved special keywords. There are more by the way. ;-)
0
ciscosuppAuthor Commented:
so basically when i have another subnet say 10.10.10.0/24 in the inside of my asa and i configure nat (inside,outside) source dynamic 192.168.1.0 255.255.255.0 interface
the internet from subnet 10.10.10.0/24 will not have internet access only subnet 192.168.1.0 255.255.255.0 is this correct
0
InteraXCommented:
If all your traffic is via the proxy server, then possibly. you would need to add a route off to the additional subnet on that server and then it could get to the intrernet.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Cisco

From novice to tech pro — start learning today.