Came across an unusual example of NAT in an ASA recently, difficult to explain but it looked like it was doing a double NAT.
Outside IP 18.104.22.168 Mail server 192.168.1.10 (real IP)
In the config there were standard nat rules which translated the destination/outside IP to other IPs (one-many), however the IP it was translated to was for example 172.16.1.10
There was then another nat rule which translated the whole subnet 172.16.1.x to 192.168.1.x, the access list obviously reflected access from the outside to the translated IP 172.16.1.10
The guy which configured it seemed to make out it increased security as it masked the internal IP range, just wondered what other peoples opinions are as it seems pointless to me - the dst and source nat rules surely hide the internal ip scheme anyway??
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...