The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.
Course Of The Month
4 days, 2 hours left to enrollBecome a Premium Member and unlock a new, free course in leading technologies each month.
Solved
Any one can explain asa static nat question ?
Posted on 2014-04-28
Expert, Can you answer the question for me ? I found a configuration in ASA 5520(ver 8.2). The firewall configuration just has one outside
interface ip address, and it has several static nat configuration. In its configuration static (inside,outside), the "outside" ip address
is different from the ASA physical outside interface ip address network.
For example:
interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 1.1.1.1 255.255.255.0
static (inside,outside) 2.2.2.2 10.1.1.1
The ip address 1.1.1.1 and 2.2.2.2 are in different net, how can it work ?
Thank you
interface ip address, and it has several static nat configuration. In its configuration static (inside,outside), the "outside" ip address
is different from the ASA physical outside interface ip address network.
For example:
interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 1.1.1.1 255.255.255.0
static (inside,outside) 2.2.2.2 10.1.1.1
The ip address 1.1.1.1 and 2.2.2.2 are in different net, how can it work ?
Thank you
[X]
Welcome to Experts Exchange
Add your voice to the tech community where 5M+ people just like you are talking about what matters.
- Help others & share knowledge
- Earn cash & points
- Learn & ask questions
3
2-
2
- +2
10 Comments
Active today
>> is different from the ASA physical outside interface ip address network
Yes
Before version 8.3 the command looked like
static (inside,outside) {outside ip address} {inside ip address}netmask {the netmask}
Yes
Before version 8.3 the command looked like
static (inside,outside) {outside ip address} {inside ip address}netmask {the netmask}
Typically you are assigned multiple IP addresses from your ISP.
For instance:
12.34.56.0/29
The ISP router we will assume is 12.34.56.1
Your firewall we will assume is 12.34.56.2
This would give you four usable IPs
12.34.56.3
12.34.56.4
12.34.56.5
12.34.56.6
Most people only have one device on the internet and everything is behind the firewall.
Now assume that you have a web server on 192.168.1.80
You create a static NAT
static (inside,outside) 12.34.56.3 192.168.1.80 netmask 255.255.255.255
This now makes IP 12.34.56.3 exposed to the internet and redirects all traffic from this public IP to it's internal IP.
A firewall rule "ACL" is required to control access to this server
For instance:
12.34.56.0/29
The ISP router we will assume is 12.34.56.1
Your firewall we will assume is 12.34.56.2
This would give you four usable IPs
12.34.56.3
12.34.56.4
12.34.56.5
12.34.56.6
Most people only have one device on the internet and everything is behind the firewall.
Now assume that you have a web server on 192.168.1.80
You create a static NAT
static (inside,outside) 12.34.56.3 192.168.1.80 netmask 255.255.255.255
This now makes IP 12.34.56.3 exposed to the internet and redirects all traffic from this public IP to it's internal IP.
A firewall rule "ACL" is required to control access to this server
Active today
e.g (pre 8.3)
global (outside) 1 interface <-The outside IP is the one on the interface
nat (inside) 1 0.0.0.0 0.0.0.0
interface Vlan2
nameif outside
security-level 0
ip address 123.123.123.123 255.255.255.248 <-This one!
But we can also have a static NAT
static (inside,outside) 123.123.123.124 192.168.1.10 netmask 255.255.255.0
So both 123.123.123.123 and 123.123.123.124 are reachable from outside.
Pete
global (outside) 1 interface <-The outside IP is the one on the interface
nat (inside) 1 0.0.0.0 0.0.0.0
interface Vlan2
nameif outside
security-level 0
ip address 123.123.123.123 255.255.255.248 <-This one!
But we can also have a static NAT
static (inside,outside) 123.123.123.124 192.168.1.10 netmask 255.255.255.0
So both 123.123.123.123 and 123.123.123.124 are reachable from outside.
Pete
Active today
For static NAT after version 8.3 see
Add a Static (One to One) NAT Translation to a Cisco ASA 5500 Firewall
Pete
Add a Static (One to One) NAT Translation to a Cisco ASA 5500 Firewall
Pete
Thank you for your fast reply.
interface Vlan2but 123.123.123.123, and 123.123.123.124 are same ip address net. If they are in different net, for example 1.1.1.1 is its physical ip address and 222.222.222.222 is static outside ip address. Even if it can work, how does its routing work well ?
nameif outside
security-level 0
ip address 123.123.123.123 255.255.255.248 <-This one!
But we can also have a static NAT
static (inside,outside) 123.123.123.124 192.168.1.10 netmask 255.255.255.0
So both 123.123.123.123 and 123.123.123.124 are reachable from outside.
Active 7 days ago
This is possible. I've seen configurations where the firewall has an IP address in a small subnet, for example 1.1.1.0/30. Here the firewall has IP 1.1.1.1 and the ISP router (the firewalls' default gateway) has 1.1.1.2. Now, this subnet is completely used.
If one would like an additional range, like 2.2.2.0/28 (so 14 extra addresses), this can be arranged by letting the ISP router route this subnet through the IP of the firewall. So the ISP has to make arrangements for that.
Once in place, the 2.2.2.0/28 subnet can be 'catched' by the firewall by means of the statics as stated in the original question.
If one would like an additional range, like 2.2.2.0/28 (so 14 extra addresses), this can be arranged by letting the ISP router route this subnet through the IP of the firewall. So the ISP has to make arrangements for that.
Once in place, the 2.2.2.0/28 subnet can be 'catched' by the firewall by means of the statics as stated in the original question.
To Ernie, you are right. But i do not know how the subnet 2.2.2.0/28 route out ? i think if client firewall has the additional ip address(2.2.2.0/28), ISP router must has 2.2.2.0/28 for it, do you think so ? Thank you.
Active 7 days ago
Not sure if I understand your question, but I'll try to give an answer.
The ISP router has a route to the 2.2.2.0/28 network, because the ISP put that in. Something like:
ip route 2.2.2.0 255.255.255.240 1.1.1.1 = forward the packets destined for the 2.2.2.0/28 network to 1.1.1.1. The router knows how to get to 1.1.1.1, because that is a directly attached network.
The ISP router has a route to the 2.2.2.0/28 network, because the ISP put that in. Something like:
ip route 2.2.2.0 255.255.255.240 1.1.1.1 = forward the packets destined for the 2.2.2.0/28 network to 1.1.1.1. The router knows how to get to 1.1.1.1, because that is a directly attached network.
Featured Post
Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.
One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.
Question has a verified solution.
If you are experiencing a similar issue, please ask a related question
If you have an ASA5510 then this sort of thing would be better handled with a CSC Module, however on an ASA5505 thats not an option, and if you want to throw in a quick solution to stop your staff going to facebook during work time, then this is the…
For months I had no idea how to 'discover' the IP address of the other end of a link (without asking someone who knows), and it drove me batty.
Think about it. You can't use Cisco Discovery Protocol (CDP) because it's not implemented on the ASAs.…
Both in life and business – not all partnerships are created equal.
As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’
As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Suggested Courses
Course of the Month4 days, 2 hours left to enroll
Earn Certification
Cisco CCNA Collaboration: CIVND2
$197.00$177.30
Earn Certification
Cisco CCNA Security: IINS v3.0
$197.00$177.30
691 members asked questions and received personalized solutions in the past 7 days.
Join the community of 500,000 technology professionals and ask your questions.