1

So is it possible to nat from inside to outside interface but not the inside ip subnet, rather the ip subnet that is routed to inside interface?

#object network remote_ip_subnet
#subnet 192.168.1.0 255.255.255.0
#nat (inside,outside) dynamic interface

#interface gigabitethernet0/1
#nameif inside
#ip address 172.16.0.1 255.255.255.252

Of course, I have static route to that remote ip subnet.

I am asking this, because i am testing this in packet tracer...and i am not sure if packet tracer has limitations or this is not possible.

1
  • In simple terms, yes, the ASA nat engine can turn any address into any other address, in either direction -- including both directions.
    – Ricky
    Jun 22 at 22:00
1

First, yes, Packet Tracer is extremely limited. It’s a learning tool for passing exams, so it lacks TONS of functionality that real devices have.

As for your main question, absolutely you can do that. Your inside interface, as you have it configured, looks to be simply an access segment to something else (likely a switch), where your real inside network resides at, which is an extremely common scenario.

So, yes, you’d do your NAT statement exactly as you have it, on the object that defines your inside network, and referencing your inside interface as the source since that’s the interface the network is reachable on.

Now, you didn’t provide your route statement but I can assume that it’s route inside 192.168.1.0 255.255.255.0 172.16.0.2

Assuming that the route is valid and you have the 192.168.1.0/24 network properly defined on whatever 172.16.0.2 is (I assume a switch), it would work in the real world. In Packet Tracer, I couldn’t say. Hardly anyone here has it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.