Can an ASA 5525-X dynamically PAT one IP subnet of private addresses (from inside port to outside port) and simultaneously pass another subnet through without PAT?
I have a public IP address on the outside interface and another public IP subnet behind the firewall.
- outside interface - 198.98.9.1/24
- ISP gateway 198.98.9.2
- Private IP - 192.168.1.1/24. The inside interface connects to another router at 192.168.1.2/24. That router has:
- Private interface 191.167.1.1/24
- Public interface 187.87.7.1/27
My goal is to dynamically PAT only IP subnet 191.167.1.0/24 and not IP subnet 187.87.7.0/27.
interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 198.98.9.1 255.255.255.0
!
interface GigabitEthernet0/1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
ASA(config)#object network PUBLIC
ASA(config-obj)#subnet 187.87.7.0 255.255.255.224
ASA(config)#object network PRIVATE
ASA(config-obj)#subnet 191.167.1.0 255.255.255.0
ASA(config)#object network INTERNET
ASA(config-obj)#subnet 0.0.0.0 0.0.0.0
ASA(config)#nat (inside,outside) source dynamic PRIVATE interface
ASA(config)#nat (inside,outside) source static PUBLIC PUBLIC destination static INTERNET INTERNET
Routing between router and asa is simple. I have default route on cisco router forward to inside asa address. And on asa default route forward to ISP address. On other direction on asa I have two static routes forward to public and private ip subnet.
Can something like this work?