Solved: NAT from private IP address

dianewalker · ‎03-29-2010

We have an ASA 5550. How do you write a NAT statement from the inside private IP 192.168.100.1(server) to a public IP address?

Thanks.

Diane

Jon Marshall · ‎03-29-2010

dianewalker wrote:
We have an ASA 5550.  How do you write a NAT statement from the inside private IP 192.168.100.1(server) to a public IP address?
Thanks.
Diane

Diane

static (inside,outside) 192.168.100.1 netmask 255.255.255.255

Jon

Cisco are currently donating money to the Haiti earthquake appeal for every rating so please consider rating all helpful posts.

View solution in original post

Jon Marshall · ‎03-29-2010

dianewalker wrote:
Thanks for your prompt response, Jon.
Another question: Instead of NATTING each individual private IP address to each individual public IP address, can you also NATTING the entire subnet?  For example, can you do this?
static (inside,outside)  192.168.100.0 netmask 255.255.255.0
Also, would you recommend natting each individual IP address or the entire subnet?
Thanks.
Diane

Diane

Apologies, i missed your response.

No your static wouldn't work because with static NAT as above you need a one to one mapping so with your static above the firewall would have no way of knowing which 192.168.100.x address to map to the public IP.

You could do this -

static (inside,outside) 192.168.100.0 netmask 255.255.255.0

where the public IP subnet has a subnet mask of 255.255.255.

For static NAT i would recommend only Natting the IPs you have to for security purposes as much as anything else.

Jon

View solution in original post

Jon Marshall · ‎03-29-2010

dianewalker wrote:
We have an ASA 5550.  How do you write a NAT statement from the inside private IP 192.168.100.1(server) to a public IP address?
Thanks.
Diane

Diane

static (inside,outside) 192.168.100.1 netmask 255.255.255.255

Jon

Cisco are currently donating money to the Haiti earthquake appeal for every rating so please consider rating all helpful posts.

dianewalker · ‎03-29-2010

Thanks for your prompt response, Jon.

Another question: Instead of NATTING each individual private IP address to each individual public IP address, can you also NATTING the entire subnet? For example, can you do this?

static (inside,outside) 192.168.100.0 netmask 255.255.255.0

Also, would you recommend natting each individual IP address or the entire subnet?

Thanks.

Diane

Jon Marshall · ‎03-29-2010

dianewalker wrote:
Thanks for your prompt response, Jon.
Another question: Instead of NATTING each individual private IP address to each individual public IP address, can you also NATTING the entire subnet?  For example, can you do this?
static (inside,outside)  192.168.100.0 netmask 255.255.255.0
Also, would you recommend natting each individual IP address or the entire subnet?
Thanks.
Diane

Diane

Apologies, i missed your response.

No your static wouldn't work because with static NAT as above you need a one to one mapping so with your static above the firewall would have no way of knowing which 192.168.100.x address to map to the public IP.

You could do this -

static (inside,outside) 192.168.100.0 netmask 255.255.255.0

where the public IP subnet has a subnet mask of 255.255.255.

For static NAT i would recommend only Natting the IPs you have to for security purposes as much as anything else.

Jon