Hi Mauth,

Thanks for your response. I have added access-list & routes but my concern is how to nat my Destination PublicIP(210.*.*.23) to 10.10.128.121 in ASA1 and divert the that traffic through its DMZ.

Regards

Jithesh

Hi Jithesh,

Let me ask u a question, ror the 210.*.*.* network, are the public IP addresses directly assigned to the servers? or they have private IP addresses and statically NATed to public IPs on ASA2?

Hi mauth

They have private IP addresses and statically NATed to public IPs on ASA2.

So can we nat the DestinationIP( 210.*.*.* )to 10.10.128.121 in ASA1 ?

Regards

Jithesh

No need,

is simple, do a NAT exclude on both firewalls so that traffic between the 192.168.1.0/24 and 10.10.128.0/24 doesn't get NATed and all traffic and both networks will be able to connect using their private IP addresses.

Cheers,

I am sorry. I could not express myself.

ASA1 is connected to a layer3 switch which is behind the ASA2. So this traffic will not pass throgh ASA2.

Thanks

Since traffic will not be passing thru ASA2, then its enough to do NAT exclude on ASA1.

NAT exclude shall look like something this:

access-list nat-exclude-acl line 1 extended permit ip 192.168.1.0 255.255.255.0 10.10.128.0 255.255.255.0

nat (inside) 0 access-list nat-exclude-acl

On ASA1, you also need to add a static route that looks something like this:

route DMZ 10.10.128.0 255.255.255.0 X

where X is the ip address of the layer 3 switch (the next hop).

On the layer 3 switch, you will need a static route that looks like this:

IP route 192.168.1.0 255.255.255.0 Y

where Y is the IP address of the DMZ interface on ASA1 (next hop)

Cheers