NAT Statements

Answered Question
May 8th, 2010
User Badges:

We have a new ASA 5510.  We are not sure of the basic configurations.   We want to use the ASA as a firewall and VPN.  For the VPN, we are going to setup group policies for the VPN client.  There is no router between the ASA and the internal networks.  Here is the basic configuration.  Do you see anything wrong?  Is there anything else that we need to setup in terms of routing?


1.  The outside IP address is 66.102.7.17, network mask 255.255.255.248, gateway 66.102.7.22.   Is this what we would enter on the Outside interface?


interface Ethernet0/0
nameif Outside
security-level 0
ip address 66.102.7.17 255.255.255.0


2.  We  want to NAT each private IP address to each public IP address.  The public IP addresses are from 209.145.25.1 - 209.145.25.62, subnet mask 255.255.255.192.   Are these the correct NAT statements?


static (Inside,Outside) 209.145.25.1 192.168.100.1 netmask 255.255.255.255
static (Inside,Outside) 209.145.25.2 192.168.100.2 netmask 255.255.255.255
static (Inside,Outside) 209.145.25.3 192.168.100.3 netmask 255.255.255.255
static (Inside,Outside) 209.145.25.4 192.168.100.4 netmask 255.255.255.255
static (Inside,Outside) 209.145.25.5 192.168.100.5 netmask 255.255.255.255


3.  This is the Route Outside statement.  Does it look correct?  The IP address 66.102.7.22 is the default gateway of 66.102.7.17 which is the outside interface of ASA


route Outside 0.0.0.0 0.0.0.0 66.102.7.22 1


3.  Since the outside interface of the ASA  and the public IP addresses are on different networks, do we need another route statement?


Thanks.


Diane

Correct Answer by Federico Coto F... about 7 years 3 weeks ago

Diane,


Everything is correct with these exceptions:

1. Change the mask

interface e0/0
no ip add
ip address 66.102.7.17 255.255.255.248


2. Since the public IPs are on a different subnet than the outside IP of the ASA, you need to make sure the ISP knows how to send
to the ASA the traffic intended to those IPs.


Hope to help.


Federico.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
Federico Coto F... Sat, 05/08/2010 - 20:57
User Badges:
  • Green, 3000 points or more

Diane,


Everything is correct with these exceptions:

1. Change the mask

interface e0/0
no ip add
ip address 66.102.7.17 255.255.255.248


2. Since the public IPs are on a different subnet than the outside IP of the ASA, you need to make sure the ISP knows how to send
to the ASA the traffic intended to those IPs.


Hope to help.


Federico.

Kent Heide Sun, 05/09/2010 - 03:06
User Badges:

The ISP has most likely allocated you a range to use for statics and these are

published into the ISP's routing table from your CPE interface. The moment you add those statics in your ASA it will act as a proxy-arp for those IPs. In other words making it work :-)


The rest of your config looks ok.

Actions

This Discussion