cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
494
Views
0
Helpful
4
Replies

Reverse Global and NAT statements...can this work??

opers13
Level 1
Level 1

this is what I'm trying to do..on an ASA5510 can I config global and nat statements but in reverse... instead of:

global (outside) 98 10.153.98.1

nat (inside) 98 10.255.0.0 255.255.0.0

I'm trying to get this to work:

global (inside) 98 10.153.98.1

nat (outside) 98 10.255.0.0 255.255.0.0

as of right now it doesn't work...I can get this to work with a static NAT....any ideas..is this even possible?

1 Accepted Solution

Accepted Solutions

Jon Marshall
Hall of Fame
Hall of Fame

Alex

Should work. Try modifying nat line to

nat (outside) 98 10.255.0.0 255.255.0.0 outside

Jon

View solution in original post

4 Replies 4

Jon Marshall
Hall of Fame
Hall of Fame

Alex

Should work. Try modifying nat line to

nat (outside) 98 10.255.0.0 255.255.0.0 outside

Jon

Alex,

What is the security level for these interfaces? Same security?

Pls. read here: http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/cfgnat.html#wp1042673

Logically what you are trying to do should work even if it is same security.

Now, you need to provide translation for the other way as well that is why your static works (static is bi-directional) and nat/global is not.

global (inside) 98 10.153.98.1

nat (outside) 98 10.255.0.0 255.255.0.0

you also need

nat (inside) 1 10.153.98.0 255.255.255.0

global (outside) 1 interface

#######################################

If outside security is lower than the inside the, you need the "outside" keyword to translate from low to high.

http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/no.html#wp1737858

outside (Optional) If this interface is on a lower security level than the interface you identify by the matching global statement, then you must enter outside. This feature is called outside NAT or bidirectional NAT.

-KS

KS,

thank you as well..

Jon, this is working now..Thanks!!

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Review Cisco Networking products for a $25 gift card