ASA Firewall Dynamic NAT configuration
Description:
OUTSIDE simulates the public network: interface IP:200.200.200.200/24,lo0:8.8.8.8/32,lo10:114.114.114.114/32: eBank 0
INSIDE simulates the intranet: vlan 10 VLANs 10.10.10.1 Universe 24 ASA 20 VLANs 20 VLANs 10.10.20.1 VLANs 20 VLANs 10.10.20.1 Plaza 24; the default route points to VLANs firewall-10.10.10.2.
The ASA firewall default route points to OUTSIDE-200.200.200.200,10.0.0.0/8 and the next hop points to INSIDE-10.10.10.1.
Requirement: INSIDE-10.10.10.0/24 needs to access the public network (8.8.8.8)
Method 1: dynamic NAT
1. Create a new network object
two。 Do NAT under object (use public network interface address for translation)
Object network INSIDE-10.10.10.0
Subnet 10.10.10.0 255.255.255.0
Nat (inside,outside) dynamic interface
Exit
Access-list OUT-TO-INSIDE extended permit ip any 10.10.10.0 255.255.255.0 / / Simulator requires this policy, but real equipment does not need it.
This strategy is required for access-group OUT-TO-INSIDE in interface outside / / simulators, but not for real devices.
test
INSIDE#ping 8.8.8.8 source vlan 10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
Packet sent with a source address of 10.10.10.1
!
Success rate is 100 percent (5amp 5), round-trip min/avg/max = 1-1-2 ms
View the NAT translation of ASA Firewall:
ASA (config) # show xlate
1 in use, 3 most used
Flags: d-DNS, e-extended, I-identity, I-dynamic, r-portmap
S-static, T-twice, N-net-to-net
ICMP PAT from inside:10.10.10.1/22 to outside:200.200.200.1/22 flags ri idle 0:00:01 timeout 0:00:30
Method 2: dynamic NAT
1. Create a new network object
two。 Do NAT under object (use a separate public network IP for conversion)
Object network INSIDE-10.10.10.0
Subnet 10.10.10.0 255.255.255.0
Nat (inside,outside) dynamic 200.200.200.10
Exit
Access-list OUT-TO-INSIDE extended permit ip any 10.10.10.0 255.255.255.0 / / Simulator requires this policy, but real equipment does not need it.
This strategy is required for access-group OUT-TO-INSIDE in interface outside / / simulators, but not for real devices.
Test:
INSIDE#ping 8.8.8.8 source vlan 10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
Packet sent with a source address of 10.10.10.1
!
Success rate is 100 percent (5amp 5), round-trip min/avg/max = 1-4-7 ms
ASA# show xlate
1 in use, 4 most used
Flags: d-DNS, e-extended, I-identity, I-dynamic, r-portmap
S-static, T-twice, N-net-to-net
ICMP PAT from inside:10.10.10.1/27 to outside:200.200.200.10/27 flags ri idle 0:00:00 timeout 0:00:30
