question about nat on asa v8.0 with same-security interfaces

mat_rouch · ‎05-04-2012

I want to make sure I understand how the nat requirements work on asa v8.0 when inter-interface is set. Background:

nat control is off.

same-security-traffic permit inter-interface is on.

"inside" and "MPLS" interfaces are both at security level 100.

"outside" is, of course, as security level 0.

The relevant config looks like this:

interface Ethernet0/0

nameif outside

security-level 0

ip address <public IP>

!

interface Ethernet0/1

no nameif

security-level 100

no ip address

!

interface Ethernet0/1.10

vlan 10

nameif inside

security-level 100

ip address 192.168.2.1 255.255.255.0

interface Ethernet0/1.20

vlan 20

nameif MPLS

security-level 100

ip address 192.168.3.1 255.255.255.0

access-list inside_nat0_outbound extended permit ip any Net-192.168.105.0 255.255.255.0

access-list MPLS_nat0_outbound extended permit ip any Net-192.168.0.105 255.255.255.0

global (outside) 101 interface
nat (inside) 0 access-list inside_nat0_outbound_1
nat (inside) 101 Net-192.168.0.0 255.255.0.0

nat (MPLS) 0 access-list MPLS_nat0_outbound
nat (MPLS) 101 Net-192.168.0.0 255.255.0.0

static (MPLS,outside) <public IP> <MPLS internal IP> netmask 255.255.255.255
static (inside,outside) <public IP> <inside internal IP> netmask 255.255.255.255

Am I correct in thinking that traffic will pass between inside (192.168.2.x) and MPLS (192.168.3.x) in either direction with NO natting, assuming the access-groups assigned to the interfaces permit the traffic?

Thanks,

-Mathew

Maykol Rojas · ‎05-04-2012

Matt,

Nope, because in your Nat0 is not defined for those two networks, they will end up hitting the egular NAT inside that actually covers it and it will say no translation group found.

Mike

mat_rouch · ‎05-04-2012

I had been under the impression that if there was no nat or static that matched it woul permit the traffic with no natting.

If I add one line:

access-list MPLS_nat0_outbound extended permit ip Net-192.168.0.0 255.255.0.0 Net-192.168.0.0 255.255.0.0

Should it work for traffic originating from either inside or MPLS? Based on my packet-tracer output it appears that it should.

Thanks,

-Mathew

Maykol Rojas · ‎05-04-2012

Matt,

You are Totally right, however this Nat rule

nat (inside) 101 Net-192.168.0.0 255.255.0.0

Is a /16 Which will take 192.168.3.0, will use that NAT and then try to find a global for it. Now, If you add that ACL as part of your NAT0 configuration, that will do the trick.

Mike.

Mike