Solved

Any one can explain asa static nat question ?

Posted on 2014-04-28
10
374 Views
Last Modified: 2014-07-07
Expert, Can you answer the  question for me ? I found a configuration in ASA 5520(ver 8.2). The firewall configuration just has one outside
 interface ip address, and it has several static nat configuration. In its configuration static (inside,outside), the "outside" ip address
 is different from the ASA  physical outside interface ip address network.

For example:
interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address 1.1.1.1 255.255.255.0

static (inside,outside) 2.2.2.2 10.1.1.1
The ip address 1.1.1.1 and 2.2.2.2 are in different net, how can it work ?

Thank you
0
Comment
Question by:EESky
  • 3
  • 2
  • 2
  • +2
10 Comments
 
LVL 57

Accepted Solution

by:
Pete Long earned 250 total points
ID: 40028339
>> is different from the ASA  physical outside interface ip address network

Yes

Before version 8.3 the command looked like

static (inside,outside) {outside ip address} {inside ip address}netmask {the netmask}
0
 
LVL 1

Assisted Solution

by:WilliamBeattie
WilliamBeattie earned 84 total points
ID: 40028344
Typically you are assigned multiple IP addresses from your ISP.

For instance:

12.34.56.0/29
The ISP router we will assume is 12.34.56.1
Your firewall we will assume is 12.34.56.2

This would give you four usable IPs
12.34.56.3
12.34.56.4
12.34.56.5
12.34.56.6

Most people only have one device on the internet and everything is behind the firewall.

Now assume that you have a web server on 192.168.1.80

You create a static NAT
static (inside,outside) 12.34.56.3 192.168.1.80 netmask 255.255.255.255

This now makes IP 12.34.56.3 exposed to the internet and redirects all traffic from this public IP to it's internal IP.

A firewall rule "ACL" is required to control access to this server
0
 
LVL 57

Assisted Solution

by:Pete Long
Pete Long earned 250 total points
ID: 40028345
e.g (pre 8.3)

global (outside) 1 interface <-The outside IP is the one on the interface
nat (inside) 1 0.0.0.0 0.0.0.0


interface Vlan2
 nameif outside
 security-level 0
 ip address 123.123.123.123 255.255.255.248 <-This one!

But we can also have a static NAT

static (inside,outside) 123.123.123.124 192.168.1.10 netmask 255.255.255.0

So both 123.123.123.123 and 123.123.123.124 are  reachable from outside.

Pete
0
 
LVL 57

Assisted Solution

by:Pete Long
Pete Long earned 250 total points
ID: 40028349
0
 

Author Comment

by:EESky
ID: 40028390
Thank you for your fast reply.

interface Vlan2
 nameif outside
 security-level 0
 ip address 123.123.123.123 255.255.255.248 <-This one!

But we can also have a static NAT

static (inside,outside) 123.123.123.124 192.168.1.10 netmask 255.255.255.0

So both 123.123.123.123 and 123.123.123.124 are  reachable from outside.

but 123.123.123.123, and 123.123.123.124 are same ip address net. If they are in different net, for example 1.1.1.1 is its physical ip address and 222.222.222.222 is static outside ip address. Even if it can work, how does its routing work well ?
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 35

Assisted Solution

by:Ernie Beek
Ernie Beek earned 166 total points
ID: 40030125
This is possible. I've seen configurations where the firewall has an IP address in a small subnet, for example 1.1.1.0/30. Here the firewall has IP 1.1.1.1 and the ISP router (the firewalls' default gateway) has 1.1.1.2. Now, this subnet is completely used.
If one would like an additional range, like 2.2.2.0/28 (so 14 extra addresses), this can be arranged by letting the ISP router route this subnet through the IP of the firewall. So the ISP has to make arrangements for that.
Once in place, the 2.2.2.0/28 subnet can be 'catched' by the firewall by means of the statics as stated in the original question.
0
 

Author Comment

by:EESky
ID: 40031120
To Ernie, you are right. But i do not know how the subnet 2.2.2.0/28 route out ? i think if client firewall has the additional ip address(2.2.2.0/28), ISP router must has 2.2.2.0/28 for it, do you think so ? Thank you.
0
 
LVL 35

Assisted Solution

by:Ernie Beek
Ernie Beek earned 166 total points
ID: 40031356
Not sure if I understand your question, but I'll try to give an answer.

The ISP router has a route to the 2.2.2.0/28 network, because the ISP put that in. Something like:
ip route 2.2.2.0 255.255.255.240 1.1.1.1 = forward the packets destined for the 2.2.2.0/28 network to 1.1.1.1. The router knows how to get to 1.1.1.1, because that is a directly attached network.
0
 

Expert Comment

by:Ramesh Suresh
ID: 40181861
Hi
0
 

Expert Comment

by:Ramesh Suresh
ID: 40181865
Hi All


             I have 1 physical ip 192.168.X.X . I want to do 3 NAT's in ASA. theses are different locations. NAT IP's are 10.254.X.X  ,. 10.250.X  and 172.27.X.X.  any body cam help me .
0

Featured Post

Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Copy files flash files using tftp 6 31
Cisco Any Connect Client 5 36
Radius ASA Authentication Failed 4 48
ASA - RV130 VPN tunnel, cannot pass traffic 8 48
There are many useful and sometimes not well documented or forgotten IOS or ASA/PIX commands. See IPE article here , there was also one on PacketU and on Cisco Tips & Tricks. Below are my favorites. I give also a few most often used for Cisco IPS an…
I recently updated from an old PIX platform to the new ASA platform.  While upgrading, I was tremendously confused about how the VPN and AnyConnect licensing works.  It turns out that the ASA has 3 different VPN licensing schemes. "site-to-site" …
This video explains how to create simple products associated to Magento configurable product and offers fast way of their generation with Store Manager for Magento tool.
Concerto provides fully managed cloud services and the expertise to provide an easy and reliable route to the cloud. Our best-in-class solutions help you address the toughest IT challenges, find new efficiencies and deliver the best application expe…

914 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now