Buy or Renew
Buy or Renew
Cisco + Splunk: It’s a new day for your data. Learn more.
 
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
394
Views
0
Helpful
4
Replies

Want to NAT many computers into a single IP to pass

Eduardo Guerra
Level 1
Level 1

‎07-08-2014 04:09 PM - edited ‎03-07-2019 07:59 PM

I have an ASA5510 as a default gateway. We have many branch offices and a headquarter office. We have the following services: Internet, DMZ, LAN, communication with offices, also a Credit Card POS service. i have created a PAT to reach to Credit Card service provider natted by a single IP. I cannot reach Service Provider (193.168.1.0) from my lan and want to know if my nat is working good. Please help reviewing configuration please:

 

: Saved
:
ASA Version 8.2(1)
!
hostname ASAFCHFW
domain-name farmaciachavez.com.bo
enable password 6Jfo5anznhoG00fM encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Ethernet0/0
 nameif Outside
 security-level 0
 ip address 200.87.226.122 255.255.255.248
!
interface Ethernet0/1
 nameif Branch_Office
 security-level 100
 ip address 192.168.2.1 255.255.255.0
!
interface Ethernet0/2
 nameif DMZ
 security-level 10
 ip address 172.16.31.1 255.255.255.0
!
interface Ethernet0/3
 nameif Inside
 security-level 100
 ip address 192.168.0.2 255.255.255.0
!
interface Management0/0
 nameif management
 security-level 100
 ip address 192.168.1.1 255.255.255.0
 management-only
!
boot system disk0:/asa821-k8.bin
ftp mode passive
dns server-group DefaultDNS
 domain-name farmaciachavez.com.bo
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object-group network POSLINKSER
 network-object host 192.168.41.101
 network-object host 192.168.41.102
 network-object host 192.168.41.103
 network-object host 192.168.41.104
 network-object host 192.168.41.105
 network-object host 192.168.41.106
 network-object host 192.168.27.101
 network-object host 192.168.27.102
 network-object host 192.168.27.103
 network-object host 192.168.27.104
 network-object host 192.168.27.105
 network-object host 192.168.27.106
 network-object host 192.168.42.101
 network-object host 192.168.42.102
 network-object host 192.168.42.103
 network-object host 192.168.42.104
 network-object host 192.168.42.105
 network-object host 192.168.42.106
 network-object host 192.168.23.101
 network-object host 192.168.23.102
 network-object host 192.168.23.103
 network-object host 192.168.23.104
 network-object host 192.168.23.105
 network-object host 192.168.23.106
 network-object host 192.168.39.101
 network-object host 192.168.39.102
 network-object host 192.168.39.103
 network-object host 192.168.39.104
 network-object host 192.168.39.105
 network-object host 192.168.39.106
 network-object host 192.168.40.101
 network-object host 192.168.40.102
 network-object host 192.168.40.103
 network-object host 192.168.40.104
 network-object host 192.168.40.105
 network-object host 192.168.40.106
 network-object host 192.168.0.62
access-list dmz_in extended permit tcp host 172.16.31.2 any eq smtp
access-list dmz_in extended permit tcp host 172.16.31.2 any eq www
access-list dmz_in extended permit tcp host 172.16.31.2 any eq https
access-list dmz_in extended permit tcp host 172.16.31.2 any eq 3000
access-list dmz_in extended permit tcp host 172.16.31.2 any eq 1000
access-list dmz_in extended permit udp host 172.16.31.2 any eq domain
access-list Inside extended permit ip any any
access-list Inside extended permit icmp any any
access-list Inside extended permit tcp any any
access-list 100 extended permit tcp any host 200.87.226.123 eq smtp
access-list 100 extended permit udp any host 200.87.226.123 eq domain
access-list 100 extended permit tcp any host 200.87.226.123 eq https
access-list 100 extended permit tcp any host 200.87.226.123 eq 3000
access-list 100 extended permit tcp any host 200.87.226.123 eq 1000
access-list 100 extended permit tcp any host 200.87.226.123 eq www
access-list linkser extended permit tcp object-group POSLINKSER 193.168.1.0 255.
255.255.0
pager lines 24
logging enable
logging buffered debugging
logging asdm informational
mtu Outside 1500
mtu Branch_Office 1500
mtu DMZ 1500
mtu Inside 1500
mtu management 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit host 192.168.0.43 Outside
asdm image disk0:/asdm-647.bin
asdm history enable
arp timeout 14400
global (Outside) 101 interface
global (DMZ) 101 interface
global (Inside) 102 192.168.0.3
nat (Branch_Office) 102 access-list linkser
nat (Branch_Office) 101 0.0.0.0 0.0.0.0
nat (DMZ) 101 0.0.0.0 0.0.0.0
nat (Inside) 101 0.0.0.0 0.0.0.0
static (DMZ,Inside) 172.16.31.0 172.16.31.0 netmask 255.255.255.0
static (Branch_Office,Inside) 192.168.2.0 192.168.2.0 netmask 255.255.255.0
static (Inside,DMZ) 192.168.0.0 192.168.0.0 netmask 255.255.255.0
static (Inside,Branch_Office) 192.168.0.0 192.168.0.0 netmask 255.255.255.0
static (DMZ,Branch_Office) 172.16.31.0 172.16.31.0 netmask 255.255.255.0
static (Branch_Office,DMZ) 192.168.2.0 192.168.2.0 netmask 255.255.255.0
static (Branch_Office,Inside) 192.168.3.0 192.168.3.0 netmask 255.255.255.0
static (Branch_Office,Inside) 172.16.1.0 172.16.1.0 netmask 255.255.255.0
static (Branch_Office,Inside) 172.16.2.0 172.16.2.0 netmask 255.255.255.0
static (Branch_Office,Inside) 172.16.3.0 172.16.3.0 netmask 255.255.255.0
static (Branch_Office,DMZ) 172.16.1.0 172.16.1.0 netmask 255.255.255.0
static (Branch_Office,Inside) 192.168.44.0 192.168.44.0 netmask 255.255.255.0
static (Branch_Office,Inside) 192.168.21.0 192.168.21.0 netmask 255.255.255.0
static (Branch_Office,Inside) 192.168.20.0 192.168.20.0 netmask 255.255.255.0
static (Branch_Office,Inside) 192.168.35.0 192.168.35.0 netmask 255.255.255.0
static (Branch_Office,Inside) 192.168.37.0 192.168.37.0 netmask 255.255.255.0
static (Branch_Office,Inside) 192.168.43.0 192.168.43.0 netmask 255.255.255.0
static (Branch_Office,Inside) 192.168.45.0 192.168.45.0 netmask 255.255.255.0
static (Branch_Office,Inside) 192.168.28.0 192.168.28.0 netmask 255.255.255.0
static (Branch_Office,Inside) 192.168.33.0 192.168.33.0 netmask 255.255.255.0
static (Branch_Office,Inside) 192.168.30.0 192.168.30.0 netmask 255.255.255.0
static (Branch_Office,Inside) 193.168.1.0 193.168.1.0 netmask 255.255.255.0
static (DMZ,Outside) 200.87.226.123 172.16.31.0 netmask 255.255.255.255
static (Branch_Office,Inside) 192.168.25.0 192.168.25.0 netmask 255.255.255.0
static (Branch_Office,Inside) 192.168.27.0 192.168.27.0 netmask 255.255.255.0
static (Branch_Office,Inside) 192.168.26.0 192.168.26.0 netmask 255.255.255.0
static (Branch_Office,Inside) 192.168.34.0 192.168.34.0 netmask 255.255.255.0
static (Branch_Office,Inside) 192.168.23.0 192.168.23.0 netmask 255.255.255.0
static (Branch_Office,Inside) 192.168.39.0 192.168.39.0 netmask 255.255.255.0
static (Branch_Office,Inside) 192.168.29.0 192.168.29.0 netmask 255.255.255.0
static (Branch_Office,Inside) 192.168.22.0 192.168.22.0 netmask 255.255.255.0
static (Branch_Office,Inside) 192.168.32.0 192.168.32.0 netmask 255.255.255.0
access-group dmz_in in interface DMZ
route Outside 0.0.0.0 0.0.0.0 200.87.226.121 20
route Branch_Office 172.16.1.0 255.255.255.0 192.168.2.2 1
route Branch_Office 172.16.2.0 255.255.255.0 192.168.2.2 1
route Branch_Office 172.16.3.0 255.255.255.0 192.168.2.2 1
route Branch_Office 192.1.0.0 255.255.192.0 192.168.2.2 1
route Branch_Office 192.168.20.0 255.255.255.0 192.168.2.2 1
route Branch_Office 192.168.21.0 255.255.255.0 192.168.2.2 1
route Branch_Office 192.168.22.0 255.255.255.0 192.168.2.2 1
route Branch_Office 192.168.23.0 255.255.255.0 192.168.2.2 1
route Branch_Office 192.168.25.0 255.255.255.0 192.168.2.2 1
route Branch_Office 192.168.26.0 255.255.255.0 192.168.2.2 1
route Branch_Office 192.168.27.0 255.255.255.0 192.168.2.2 1
route Branch_Office 192.168.28.0 255.255.255.0 192.168.2.2 1
route Branch_Office 192.168.29.0 255.255.255.0 192.168.2.2 1
route Branch_Office 192.168.30.0 255.255.255.0 192.168.2.2 1
route Branch_Office 192.168.32.0 255.255.255.0 192.168.2.2 1
route Branch_Office 192.168.33.0 255.255.255.0 192.168.2.2 1
route Branch_Office 192.168.34.0 255.255.255.0 192.168.2.2 1
route Branch_Office 192.168.35.0 255.255.255.0 192.168.2.2 1
route Branch_Office 192.168.37.0 255.255.255.0 192.168.2.2 1
route Branch_Office 192.168.39.0 255.255.255.0 192.168.2.2 1
route Branch_Office 192.168.43.0 255.255.255.0 192.168.2.2 1
route Branch_Office 192.168.44.0 255.255.255.0 192.168.2.2 1
route Branch_Office 192.168.45.0 255.255.255.0 192.168.2.2 1
route Branch_Office 192.168.100.0 255.255.255.0 192.168.2.2 1
route Inside 193.168.1.0 255.255.255.0 192.168.0.249 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 192.168.1.0 255.255.255.0 management
http 192.168.0.0 255.255.255.0 Inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet 0.0.0.0 0.0.0.0 Branch_Office
telnet 172.16.31.0 255.255.255.0 DMZ
telnet 192.168.0.0 255.255.255.0 Inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd enable management
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
username eguerra password dr6zkC4iOPQHLH5f encrypted privilege 15
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect icmp
  inspect icmp error
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:265359787be815a8787028dbd68d9d1c
: end

Labels:
0 Helpful
4 Replies 4

Eduardo Guerra
Level 1
Level 1

‎07-09-2014 07:07 AM

Diagram could help

Preview file
78 KB
0 Helpful

MARK BAKER
Level 4
Level 4
In response to Eduardo Guerra

‎07-09-2014 03:31 PM

I'm not sure about NATing out the same interface that the traffic came in on since I've never tried it, but if it does work, I would think you would need the below line.

nat (inside) 102 access-list linkser

Is the credit card provider reachable from the branch sites, but not from 192.168.0.62 at the corporate site?

Another option would be to move the NAT to the 192.168.0.249 router for connections to the credit card company unless that router is owned by the service provider or credit card company. You may be able to ask them to NAT anything from your company network to the WAN to 192.168.0.3.

HTH

Mark

0 Helpful

Eduardo Guerra
Level 1
Level 1
In response to MARK BAKER

‎07-10-2014 08:57 AM

Mark, what about routing on the same interface?. I want computers on network 192.168.0.0, reaches 193.168.1.0 too. I tried but cannot do it

0 Helpful

MARK BAKER
Level 4
Level 4
In response to Eduardo Guerra

‎07-12-2014 01:31 AM

I found other threads that say you need to do static NAT when on same interface.

static (inside,inside) 192.168.0.3 access-list linkser

I'm not sure if you can use the same IP that is configured in the PAT command. You may have to ask the credit card company to allow another IP.

In the linkser ACL, the only device on the 192.168.0.0 network is 192.168.0.62. You would have to use that device to test with or add additional IPs in the ACL.

HTH

Mark

0 Helpful
Customers Also Viewed These Support Documents
Review Cisco Networking products for a $25 gift card