2

Testing in a lab...I have a VLAN directly attached to a Cisco ASA 5520 that contains host machines who use IPs from a public address space, 11.11.11.0/26 for example. The ASA has two interfaces this dmz interface containing the hosts on the 11.11.11.0/26 and an outside interface containing a /30 peering point to an ASR running BGP etc.

Is there a way to configure the ASA to allow connectivity to and from this 11.11.11.0/26 without having to put in NAT statements since both interfaces are two different security-levels?

  • dmz security-level 50 (11.11.11.1/26)

  • outside security-level 0 (11.11.11.65/30) to ASR

Thanks for everyones help in advance!

1

Disable nat-control. Apply permit acl to outside interface.

  • Hmm, the command errors as it is depreciated, I am running 8.4.2 – Jim Sep 13 '16 at 20:33
  • After 8.3 there is no nat-control. So you should configure nat exemption. Here is how you can achieve that: object network LOCAL_LAN subnet 11.11.11.0 255.255.255.192 object network REMOTE_LAN subnet 11.11.11.64 255.255.255.252 nat (dmz,outside) source static LOCAL_LAN LOCAL_LAN destination static REMOTE_LAN REMOTE_LAN – Nuran Afrasiyabov Sep 13 '16 at 20:47
  • Thank Nuran, that is as far as I got however I can't specify "any" as the REMOTE_LAN?? for example what if it is 11.11.11.11 to 8.8.8.8, how do I ensure no nat control is happening? – Jim Sep 14 '16 at 12:31
  • So apparently i didn't assign my outside ACL to my outside interface via access-group command. I figured it out when I did a packet-tracer and it kept saying it was denied by ACL. Thanks for your help. – Jim Sep 14 '16 at 13:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.