Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Does double NAT work

probably a real simple question: I have a router-ASA combination. The router's WAN interface has a public IP 123.45.67.89 and there is a small stub 192.168.1.x network in between the router and the ASA and finally the web server at 172.16.1.16 I've never done double-NAT before and I can't think of any reason that it shouldn't work, but I thought I'd do a quick post here to see if the standard NAT work should across the two devices to get to an IP on the inside LAN of the ASA? (I know it would be easier to change the ASA to be in transparent mode and not do double NAT at all, but I'm not allowed to do that)

On the router, I'll have:

ip nat inside source static tcp 192.168.1.2 80 123.45.67.89 80 extendable

On the ASA, I'll have:

static (inside,outside) tcp 192.168.1.2 www 172.16.1.16 www netmask 255.255.255.255

Will this work?

Any "gotchas" that I need to know about?

3 REPLIES
Hall of Fame Super Blue

Re: Does double NAT work

Hi Thomas

If the application is fine with NAT then using NAT twice will have no impact, it should work fine.

We have to do this a number of times and it's fine although as you say there is usually a cleaner way to do it.

HTH

Jon

Re: Does double NAT work

Thomas,

I agree with Jon that it should work fine as long as the web application doesn't timeout due to any delay in additional processing by either the router/ASA. Under normal situation NAT processing on both devices should be very quick (in microseconds). The whole NAT process would be transaparent to the TCP end devices.

HTH

Sundar

New Member

Re: Does double NAT work

Hi Mate

I've used double NAT quite a few times in the past and have never had any issues, but as the other lads have said - you need to make sure that the apps are NAT friendly.

159
Views
11
Helpful
3
Replies