Cisco ASA nat from inside to outside, but network that is routed to inside interface

Question

So is it possible to nat from inside to outside interface but not the inside ip subnet, rather the ip subnet that is routed to inside interface?

#object network remote_ip_subnet
#subnet 192.168.1.0 255.255.255.0
#nat (inside,outside) dynamic interface

#interface gigabitethernet0/1
#nameif inside
#ip address 172.16.0.1 255.255.255.252

Of course, I have static route to that remote ip subnet.

I am asking this, because i am testing this in packet tracer...and i am not sure if packet tracer has limitations or this is not possible.

Answer 1

First, yes, Packet Tracer is extremely limited. It’s a learning tool for passing exams, so it lacks TONS of functionality that real devices have.

As for your main question, absolutely you can do that. Your inside interface, as you have it configured, looks to be simply an access segment to something else (likely a switch), where your real inside network resides at, which is an extremely common scenario.

So, yes, you’d do your NAT statement exactly as you have it, on the object that defines your inside network, and referencing your inside interface as the source since that’s the interface the network is reachable on.

Now, you didn’t provide your route statement but I can assume that it’s route inside 192.168.1.0 255.255.255.0 172.16.0.2

Assuming that the route is valid and you have the 192.168.1.0/24 network properly defined on whatever 172.16.0.2 is (I assume a switch), it would work in the real world. In Packet Tracer, I couldn’t say. Hardly anyone here has it.