Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Natting issue

Hi,

I have 1 ASA connected with L3 3550 switch in L3 mode. In ASA natting for inside & global outside is configured with proper static routing.

ENd user is being assigned with manual ip. The problem is whenever any end machine comes up in the network automatically it is natted with a public ip from global ip pool configured in the asa.

I blocked the netwbios ports in the switch using acl but still the problem persists.

any suggestion plz..

4 REPLIES
New Member

Re: Natting issue

if you dont mind post your config.

regs

S.mohana sundaram

New Member

Re: Natting issue

ASA:

===========================================

interface GigabitEthernet0/0

description @@@ Connected with Router Gig 0/0/1 @@@

nameif outside

security-level 0

ip address 125.20.1.2 255.255.255.224

!

interface GigabitEthernet0/1

description @@@ Connected with Core Switch @@@

nameif inside

security-level 100

ip address 192.168.255.5 255.255.255.252

!

interface GigabitEthernet0/2

description @@@ DMZ ZONE @@@

nameif dmz

security-level 50

ip address 192.168.10.1 255.255.255.192

access-list 110 permit tcp any any eq 53

access-list 110 permit udp any any eq 53

access-list 110 permit tcp any any eq 80

access-list 110 permit tcp any any eq 443

access-list 110 permit tcp any any eq 25

access-list 110 permit tcp any any eq 110

access-list 110 permit icmp any any eq echo-reply

global (outside) 1 210.212.10.2-210.212.10.14 netmask 255.255.255.240

nat (inside) 1 192.168.10.0 255.255.255.0

access-group 110 in inerface outside

access-group 110 in inerface inside

access-group 110 in inerface dmz

route outside 0.0.0.0 0.0.0.0 125.20.1.1 1

route inside 192.168.0.0 255.255.0.0 192.168.255.6

=============================================

L3 Switch:

Int vlan 2

ip address 192.168.10.1 255.255.255.0

Int gi0/7

no switchport

ip address 192.168.255.6 255.255.255.252

description ### connected with firewall ###

ip route 0.0.0.0 0.0.0.0 192.168.255.5

Re: Natting issue

based on ur config anydevice in network 192.168.10.0/24 want to go to the internet will use any available ip in ur pool

what u want to do exactly ?

New Member

Re: Natting issue

The problem is: whenever any machine comes up with IP 192.168.10.0/24, it automatically gets natted & being asigned a free public ip from the pool.

If i want to access internet then only it should be natted. But in my case if a ping a local machine in the lan, then also using "sh xlate" command i can see that my local ip has been natted with a public ip.

119
Views
0
Helpful
4
Replies