0

Topology: enter image description here

How to set up NAT in Cisco ASA Firewall (in Packet Tracer), when there are VLANs in the network?

In the current approach, NAT is not working to reach the server (8.8.8.8) from any of the VLANs.

It is working if I ping from the layer3 switch (172.168.0.1).

*NOTE: When used Router instead of ASA Firewall, I was able to setup NAT in it, but I am first time working with ASA firewall.

current configuration:

interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
 switchport access vlan 3
!
interface Vlan2
 nameif inside
 security-level 100
 ip address 172.16.0.2 255.255.0.0
!
interface Vlan3
 nameif outside
 security-level 0
 ip address 51.1.1.1 255.0.0.0
!
object network LAN
 subnet 172.16.0.0 255.255.0.0
!
route outside 0.0.0.0 0.0.0.0 51.1.1.2 1
!
access-list local-to-internet extended permit tcp any any
access-list local-to-internet extended permit icmp any any
!
!
access-group local-to-internet in interface outside
object network LAN
 nat (inside,outside) dynamic interface

Download .pkt file: https://drive.google.com/file/d/1dzZFb9S9S83wmQjTWAa2EBOxiwsV7GHg/view?usp=sharing

Improve this question
0

1 Answer 1

Reset to default
1

It's not just NAT but also routing in your case. For NAT this should do:

nat (inside,outside) after-auto source dynamic any interface

For routing you will need to route "inside" networks to your inside router:

route inside 192.168.10.0 255.255.255.0 172.16.0.1
route inside 192.168.20.0 255.255.255.0 172.16.0.1
route inside 192.168.30.0 255.255.255.0 172.16.0.1
etc.

Without this, all subnets for vlans 1, 10, 20, 30, 40, 50... are going through default route (to outside interface) as no other routes are specified. PS: Routers/switches

Improve this answer
7
  • Where should I execute (on which interface or object network subnet, etc.) "nat" command ?
    – Rajan
    Oct 6, 2021 at 14:12
  • @Rajan Those are global commands. Just enter them anywhere in config mode and they’ll go to the right place.
    – Jesse P.
    Oct 6, 2021 at 15:57
  • In ASA firewall "nat" command is only available while defining object network. I checked all available commands in the global config mode.
    – Rajan
    Oct 6, 2021 at 18:34
  • @Rajan The problem is that you’re doing this in Packet Tracer, which is just a learning tool and doesn’t support all of the functionality or commands of a real device. @PJ7’s answer is valid (since your current NAT only covers the “LAN” network and not the rest of your private networks, but your virtual device is rejecting it because Packet Tracer is junk, essentially.
    – Jesse P.
    Oct 6, 2021 at 19:33
  • 1
    @Rajan You can try other products such as Cisco VIRL or GNS3 if you’d like. It might yield better results.
    – Jesse P.
    Oct 8, 2021 at 20:56

Not the answer you're looking for? Browse other questions tagged or ask your own question.