2

I need to NAT the source address of the traffic from my local LAN going out of the ASA firewall.

enter image description here

From the diagram above, my outside interface IP on the ASA firewall is set at 192.168.12.2

q1) Am i able to set NAT on this outside interface to use another range of IP (e.g. 10.10.10.1) as its source when routing traffic from the local LAN to Router 0 (10.10.10.2) ?

q2) if the above is achievable, how does Router 0 know how to send to the ASA firewall ? Does it means that the ASA firewall will reply to ARP request for 10.10.10.1 even though its physical interface is set to 192.168.12.2 ? Does it also means that I have to turn on PROXY-ARP on the ASA firewall outside interface in order for the setup to work ?

Regards, Noob

Improve this question
7
  • Wouldn't it be simpler to give router0 a 192.168.12.3 address and a static route for 10.10.10.1/32 to 192.168.12.2 ?
    – hertitu
    Sep 23, 2016 at 21:54
  • @hertitu - you are right about what i am trying to illustrate in your reply to ron. but i can't do change the router0's ip.- this is a service provider router and they require us to come in at (10.10.10.1) but due to x,y reason happens to be in the same vlan with r1 and the asa outgoing interface.
    – Noob
    Sep 24, 2016 at 3:04
  • Do you have control over router1?
    – hertitu
    Sep 24, 2016 at 6:26
  • @hertitu nope. the router is a cpe but it belongs to the service provider
    – Noob
    Sep 24, 2016 at 6:43
  • What is the end goal? Are r0 and r1 both internet facing ? What traffic needs to go via r0 and which via r1? Will r1 go away at some point in the future?
    – hertitu
    Sep 24, 2016 at 7:51

1 Answer 1

Reset to default
1

You are changing the source address on the IP packets. Router0 will not ARP for an address in the range you are translating to because it knows it has no direct connection to that network. ARP only works for directly connected networks.

What you need to do is to let Router0 and Router1 know to go to 192.168.12.2 for any destination addresses in your translation range.

This is routing 101. A router gets routes into its routing table from three different ways: directly connected networks, statically configured routes, and/or a routing protocol.

Since your proposed network is not directly connected to either Router0 or Router1, you will need to either statically configure a route for it in those routers, or you will need to run a routing protocols with those routers and the ASA, and have the ASA tell those routers that it has your translation network via 192.168.12.2.

You also need to somehow let the ASA know what networks are behind each of the other routers.

Edit:

Based on the comments below, others think you are going to have the Router0 address in a different network than the Router1 and ASA addresses to which it connects. You can't do that unless the switch is a layer-3 switch and it routes between the interface to which Router0 connects and a VLAN to which Router1 and the ASA connect.

Improve this answer
25
  • I believe you may have misread the question, if the NAT is using 10.10.10.1 then this is directly connected for router0 and so it will arp for it.
    – hertitu
    Sep 23, 2016 at 20:40
  • 2
    You don't translate the source address to the same network as the destination address. The Router0 address toward the ASA must be in the 192.168.12.x network. If the network on the other side of Router0 is 10.10.10.x, the inside LAN cannot be the same network, else Router0 will not send traffic out a different interface since it already knows where that network is.
    – Ron Maupin ♦
    Sep 23, 2016 at 20:49
  • 3
    You're still assuming things that are not there. The LAN on the inside of the asa is not 10.10.10.0. The network on the other side of r0 is not 10.10.10.0. The interface of r0 towards the ASA is 10.10.10.2 and the outside interface of the ASA is 192.168.12.2 (and so it can successfully route via r1). So asa and r0 are in the same vlan but different subnet. now the question is, if the ASA translates the LAN to 10.10.10.1 (which is in the same subnet as r0), could this work?
    – hertitu
    Sep 23, 2016 at 21:01
  • 1
    Then IMHO that last comment should be your answer. FWIW I agree that it's a very unusual and unconventional scenario but I'm not so sure this can't work. Need to think about this some more...
    – hertitu
    Sep 23, 2016 at 21:27
  • 1
    Proxy ARP is a security risk. I don't know how else to phrase it. It is identified as a huge security risk. That is nothing I would ever recommend to anyone, especially on a publicly addressed network. If you want to put your whole business at risk, then feel free, but you should run this by your security people and auditors first.
    – Ron Maupin ♦
    Sep 24, 2016 at 5:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.