Solved: NAT Issue

vasren · ‎07-08-2010

Kindly suggest whether the below NAT configuration can be done in FWSM.

I have one Internal Interface & two external interface. The natted Global Address should be same for traffic routing via both the external interface.

static (Internal,Outside1) 115.115.115.115 10.10.10.1 netmask 255.255.255.255

static (Internal,Outside2) 115.115.115.115 10.10.10.1 netmask 255.255.255.255

IPs are dummy one (not real).

Nagaraja Thanthry · ‎07-08-2010

As long as your routers connected to those external interfaces do not reject the traffic due to RPF issues, I do not see any reason why you should not configure the way you want to configure it. Firewall will not complain. However, your external network might.

Hope this helps.

Regards,

NT

View solution in original post

Nagaraja Thanthry · ‎07-08-2010

As long as your routers connected to those external interfaces do not reject the traffic due to RPF issues, I do not see any reason why you should not configure the way you want to configure it. Firewall will not complain. However, your external network might.

Hope this helps.

Regards,

NT

vasren · ‎07-08-2010

Thanks, I will get it configured and update you on the same.

vasren · ‎07-12-2010

It worked for Static NAT. Kindly advice whether the same will hold good for PAT also. Can we configure as below, if so which is correct Option-1 or Option-2.

Option-1:

global (Outside1) 4 115.115.115.115 netmask 255.255.255.255

global (Outside2) 4 115.115.115.115 netmask 255.255.255.255

nat (Inside) 4 10.10.10.1 255.255.255.255

nat (Inside) 4 10.10.10.2 255.255.255.255

or

Option-2:

global (Outside1) 4 115.115.115.115 netmask 255.255.255.255

nat (Inside) 4 10.10.10.1 255.255.255.255

nat (Inside) 4 10.10.10.2 255.255.255.255

global (Outside2) 5 115.115.115.115 netmask 255.255.255.255

nat (Inside) 5 10.10.10.1 255.255.255.255

nat (Inside) 5 10.10.10.2 255.255.255.255

Nagaraja Thanthry · ‎07-12-2010

Hello,

The same configuration will work for PAT as well. Option 1 will satisfy your requirements. While Option 2 will also work, it is just duplicating the configuration.

Regards,

NT