Can an ASA 5525-X dynamically PAT one IP subnet of private addresses (from inside port to outside port) and simultaneously pass another subnet through without PAT?
I have a public IP address on the outside interface and another public IP subnet behind the firewall.
- outside interface - 18.104.22.168/24
- ISP gateway 22.214.171.124
- Private IP - 192.168.1.1/24. The inside interface connects to another router at 192.168.1.2/24. That router has:
- Private interface 126.96.36.199/24
- Public interface 188.8.131.52/27
My goal is to dynamically PAT only IP subnet 184.108.40.206/24 and not IP subnet 220.127.116.11/27.
interface GigabitEthernet0/0 nameif outside security-level 0 ip address 18.104.22.168 255.255.255.0 ! interface GigabitEthernet0/1 nameif inside security-level 100 ip address 192.168.1.1 255.255.255.0 ASA(config)#object network PUBLIC ASA(config-obj)#subnet 22.214.171.124 255.255.255.224 ASA(config)#object network PRIVATE ASA(config-obj)#subnet 126.96.36.199 255.255.255.0 ASA(config)#object network INTERNET ASA(config-obj)#subnet 0.0.0.0 0.0.0.0 ASA(config)#nat (inside,outside) source dynamic PRIVATE interface ASA(config)#nat (inside,outside) source static PUBLIC PUBLIC destination static INTERNET INTERNET
Routing between router and asa is simple. I have default route on cisco router forward to inside asa address. And on asa default route forward to ISP address. On other direction on asa I have two static routes forward to public and private ip subnet.
Can something like this work?