NAT example - Increased Security?

Unanswered Question

Came across an unusual example of NAT in an ASA recently, difficult to explain but it looked like it was doing a double NAT.


Outside IP
Mail server (real IP)

In the config there were standard nat rules which translated the destination/outside IP to other IPs (one-many), however the IP it was translated to was for example

There was then another nat rule which translated the whole subnet 172.16.1.x to 192.168.1.x, the access list obviously reflected access from the outside to the translated IP

The guy which configured it seemed to make out it increased security as it masked the internal IP range, just wondered what other peoples opinions are as it seems pointless to me - the dst and source nat rules surely hide the internal ip scheme anyway??

Thanks in advanced

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
praprama Thu, 09/30/2010 - 07:46
User Badges:
  • Cisco Employee,


That's interesting. I want to reserve my comments unless i am able to have a look at the example in entirety. Please share the link for that. If it is indeed implementing double NAT, it does not work.

Thanks and Regards,



This Discussion