Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

NAT related question -

Hi,


I have a question about using static NAT of ASA/FWSM. I'm doing some static NATs for our private servers on FWSM. I'm running out of public IP on the OUTSIDE subnet on the Firewall. We have some public IPs available on other internal subnets/VLANs that are not extended to the firewall.

I was wondering if I can use the public IP from internal subnet as for static NAT? For example, my OUTSIDE network is 120.30.46.0/24.


I don’t want to use any IP from this network for static NAT. Instead I want to use an internal public network IP address .10 to statically NAT an internal private IP 172.20.48.10. I am not using this network (120.30.41.x) on any interface of Firewall. Is it possible?


I do have routing in place. Both 120.30.41.x and 172.20.48.x are on INSIDE. I tried to do the following but it didn’t work:

Static (inside,inside) 120.30.41.10 172.20.48.10 netmask 255.255.255.255

I also added alias command but it did not help either.

Alias (inside) 120.30.41.10 172.20.48.10 255.255.255.255

Does anyone have any suggestion to make it work?

thanks !!

3 REPLIES

NAT related question -

Hello Fawad,

Removed the commands you entered and add the following:

static (inside,outside) 120.30.41.10 172.20.48.10

With Proxy-ARP the ASA whould reply to those packets, if this still does not work, share the following

packet-tracer input outside tcp 4.2.2.2 1025 120.30.41.10 80 (If this is not a web-server then use the right service)

Rate all of the helpful posts!!!

Regards,

Jcarvaja

Follow me on http://laguiadelnetworking.com

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC
Silver

NAT related question -

The ASA outside interface I believe has its own ISP, if that ISP is not routing that network then the answer is no.

Value our effort and rate the assistance!

Value our effort and rate the assistance!
New Member

NAT related question -

It worked with at simple static (inside,outside). Thanks Julio !

For iternal user I had to use an alias.

148
Views
0
Helpful
3
Replies
CreatePlease to create content