3

Can an ASA 5525-X dynamically PAT one IP subnet of private addresses (from inside port to outside port) and simultaneously pass another subnet through without PAT?

I have a public IP address on the outside interface and another public IP subnet behind the firewall.

  • outside interface - 198.98.9.1/24
  • ISP gateway 198.98.9.2
  • Private IP - 192.168.1.1/24. The inside interface connects to another router at 192.168.1.2/24. That router has:
    • Private interface 191.167.1.1/24
    • Public interface 187.87.7.1/27

My goal is to dynamically PAT only IP subnet 191.167.1.0/24 and not IP subnet 187.87.7.0/27.

interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address 198.98.9.1 255.255.255.0

!
interface GigabitEthernet0/1
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0 

ASA(config)#object network PUBLIC
ASA(config-obj)#subnet 187.87.7.0 255.255.255.224

ASA(config)#object network PRIVATE
ASA(config-obj)#subnet 191.167.1.0 255.255.255.0

ASA(config)#object network INTERNET
ASA(config-obj)#subnet 0.0.0.0 0.0.0.0

ASA(config)#nat (inside,outside) source dynamic PRIVATE interface

ASA(config)#nat (inside,outside) source static PUBLIC PUBLIC destination static INTERNET INTERNET

Routing between router and asa is simple. I have default route on cisco router forward to inside asa address. And on asa default route forward to ISP address. On other direction on asa I have two static routes forward to public and private ip subnet.

Can something like this work?

Improve this question
8
  • I must admit that I don't quite understand the problem, but I believe this can be done fairly easily with network objects :)
    – Goodies
    Jan 31, 2015 at 0:46
  • 3
    "can it do X": YES. HOW to do it is not the question you've asked. (and that depends on the version you're running -- old nat vs. new nat syntax. 'tho a 5525-x is almost certainly going to be 8.3+)
    – Ricky
    Jan 31, 2015 at 0:58
  • As @RickyBeam pointed out, the simple answer is "YES", it can. But if you want more help than that, you should give us some example IPs and ask us what you want translated where, and when. I'm sure someone will be able to write out the required syntax.
    – Eddie
    Jan 31, 2015 at 5:26
  • Anyone have an idea ?
    – Bla bla
    Feb 1, 2015 at 13:22
  • I cant believe nobody have an idea for required syntax ?!
    – Bla bla
    Feb 2, 2015 at 23:09

1 Answer 1

Reset to default
3

You are trying to specify a NO-NAT for your 187.87.7.0/27 but I don't know why.

Simply having "nat (inside,outside) source dynamic PRIVATE interface" will dynamically PAT your 191.167.1.0/24 to 198.98.9.1

Then traffic traversing your inside to outside will not hit the NAT statement therefore pass through without NAT?

Isn't this what you want?

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.