×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

Policy NAT question, ASA 8.2

Unanswered Question
Jun 6th, 2012
User Badges:

Hello,

I'm hoping that someone can straighten me out.  I don't have a ton of experience with ASA's and I've inherited one that I need to support.  Currently it has several IPSec tunnels terminating on it.  There is one tunnel that connects to an office with an network address conflict.  To get around this, the previous administrator put a many-to-one NAT in place:


access-list vpntraffictonat extended permit ip 192.168.0.0 255.255.255.0 10.64.0.0 255.224.0.0

access-list vpntraffictonat extended permit ip 192.168.0.0 255.255.255.0 10.251.0.0 255.255.0.0


nat (data) 2 access-list vpntraffictonat


global (outside) 2 10.201.108.2


So all the remote PC's on 192.168.0.0 are only NAT'ed to192.168.108.2 when accessing resources on 10.64.0.0.  Now they have requested the ability to connect to the remote PC's from 10.64.0.0.  I assume that I need a Policy Static, so that I don't break traffic going over the other IPSec tunnels.


no nat (data) 2 access-list vpntraffictonat

no global (outside) 2 10.201.108.2

static (data,outside) 10.201.108.0 access-list vpntraffictonat


My understanding is that this will allow two-way one-to-one NAT between these two networks?  Am I misunderstanding this use of the static command?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Jennifer Halim Wed, 06/06/2012 - 23:38
User Badges:
  • Cisco Employee,

yes, you are absolutely correct.

however, you may need to change your crypto ACL as well. If you just have host 10.201.108.2 on your crypto ACL, you would need to change it to 10.201.108.0/24, and so is the other end.

chrisnoon11 Thu, 06/07/2012 - 09:41
User Badges:

Thank you for the response.


Yeah, the SA's are already set up for the /24, which made me wonder why they didn't just setup the network static to begin with.  Thanks for the sanity check!


chris

Actions

This Discussion