Cisco ASA NAT Outside to Inside help.

soundtech85 · Sep 25, 2013

Hello.

I need some help understanding NAT in a cisco environment. Specifically this:

I am looking at our current asa that handles nat and I can see the polices in place with the show nat detail. The issue I'm having is I don't understand how services like our lync edge server / outlookweb access are being translated back into our lan. We have a few internet addresses for these services and I can see on the ASA where interfaces are setup for DMZs. They all have private ip addresses. There is an inside interface and an outside interface. The problem I'm seeing is when I do the show nat detail I only see nat polices that state inside to outside. Or DMZ-LyncEdge to outside. They are defined under Auto NAT Policies.

So my question is how can the internet address be translated into the private addressing scheme if there is only inside to outside natting? I would understand what is going on if I saw natting from outside to inside, but it doesn't exist. The network works great, but I am going to have to setup natting for some new cad apps and servers in the future.

Any advice on how nat works from outside to inside would be great and if any more detail is needed please let me know. I'm new to this and don't know exactly what to tell everyone so I can get this resolved. Thanks so much!

bill001g · Sep 25, 2013

Yes this will take a long time to get your head around cisco I think likes to make is confusing. I will in my example always assume the LAN is called inside and the internet is called outside.

There are 3 basic commands you are allowed to use

IP NAT INSIDE SOURCE
IP NAT OUTSIDE SOURCE
IP NAT INSIDE DESTINATION.

So if the traffic coming from your LAN to the Internet you want to translate the SOURCE Address. Since it is going from inside-outside the statement is ip nat inside source. Now when the traffic returns the ip you want to translate is the DESTINATION. The router is smart enough to know that this is just the reverse and will attempt to find a entry. An you will notice there is no such command as IP NAT OUTSIDE DESTINATION. If there are static entries for ports this is what consumer routers call ip forwarding. You of course can assign the complete range of ports too.

If this was the only command it would be simple to understand ...the router is just smart to understand that you also are defining the reserve mapping.

What makes life a pain are the other 2 commands. The simplest explanation I can think of is say CNN.COM has a DNS entry of 1.2.3.4 but for whatever reason you wanted the traffic to go to 3.4.5.6 you would use a IP NAT INSIDE DESTINATION command to do this. So when you wanted to go to CNN web site you would be directed to 3.4.5.6. The ip nat outside command is kinda the reverse of this.

Best is to just ignore those 2 forms of nat, they are used is very special configurations that are not real common.

Search

Cisco ASA NAT Outside to Inside help.

soundtech85

Honorable

bill001g

Titan

TRENDING THREADS

Latest posts

Moderators online

Share this page