Hi all. My office is using cisco asa 5510 as firewall and is connected to
office/dmz/internet networks. I allow my office network traffic to access dmz network but deny vice versa. To allow my office network to access dmz network i can either do NAT or NAT exemption. Using NAT would conceal my office PCs ip when they access dmz as they will be translated to a dmz ip. But it would be tough for me to do traffic monitoring in dmz as they are to many NAT done. Hence i would like to know what is the industry practise? NAT or NAT exemption? Pls advise. Thks in advance.
Its either way.. actually NAT is done the other way.. If I have servers in DMZ accessed from inside, it is good to have the server segment natted to inside with the same IP.. for eg, if inside is 10.1.0.0/16 and server segment is 172.16.1.0/24, then i would do
say 172.16.1.10 is the server that I'm trying to access.. if you want, u can do the same thing for an entire subnet.. doing this, all the servers will be visible in inside, and will be accessed with their own IP.. as u said, if u do it the other way (nat the inside to dmz ip) then it will be really tough to manage.. this is how we have implemented in most of the high end network..
Thk you very much for the reply. I think i would adopt your suggestion. But just 1 last check, is there any security consideration compare to my earlier 2 methods? Just want to ensure the security part before i proceed to implementation. Thks in advance.
there is not much of difference in the way it works (security wise) in these options.. infact, when you do a static translation, it is always the best, from security point of view.. since the translation happens 1 - to - 1, you will have the real ips of clients, in any kind of log/sniffer etc... If you are doing PAT (many to one), then the problem comes of diminished security, since the IPS/logs etc would look at the same IP address (with different port numbers), which makes troubleshooting even difficult..
but in ur case, since u are doing a 1-1 translation (either way), there is not much of difference (in security).. in fact, to increase security i would normally have an accesslist on the inside interface of the PIX, and validate traffic flow, even from inside, to dmz..
Hope this helps..all the best.. rate replies if found useful..
Your inside IP will be visible using the same IP address.. it is just that the server IP is shown to inside users, with a static NAT.. end to end communication happens through the same set of IP addresses
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...