ASA 8.3(x) Dynamic PAT with Two Internal Networks and Internet Configuration
Requirements
Ensure that you meet these requirements before you attempt this configuration:
- Make sure the internal network has two networks located on the inside of the ASA:
- 192.168.0.0/24—Network directly connected to the ASA.
- 192.168.1.0/24—Network on the inside of the ASA, but behind another device (for example, a router).
- Make sure the internal users get PAT as follows:
- Hosts on the 192.168.1.0/24 subnet will get PAT to a spare IP address given by the ISP (10.1.5.5).
- Any other host behind the inside of the ASA will get PAT to the outside interface IP address of the ASA (10.1.5.1).
Components Used
The information in this document is based on these software and hardware versions:
- Cisco Adaptive Security Appliance (ASA) with version 8.3(1)
- ASDM version 6.3(1)
ASA CLI Configuration
This document uses the configurations shown below.
| ASA Dynamic PAT Configuration |
|---|
ASA#configure terminal Enter configuration commands, one per line. End with CNTL/Z. !--- Creates an object called OBJ_GENERIC_ALL. !--- Any host IP not already matching another configured !--- object will get PAT to the outside interface IP !--- on the ASA (or 10.1.5.1), for internet bound traffic. ASA(config)#object network OBJ_GENERIC_ALL ASA(config-obj)#subnet 0.0.0.0 0.0.0.0 ASA(config-obj)#exit ASA(config)#nat (inside,outside) source dynamic OBJ_GENERIC_ALL interface !--- The above statements are the equivalent of the !--- nat/global combination (as shown below) in v7.0(x), !--- v7.1(x), v7.2(x), v8.0(x), v8.1(x) and v8.2(x) ASA code: nat (inside) 1 0.0.0.0 0.0.0.0 global (outside) 1 interface !--- Creates an object called OBJ_SPECIFIC_192-168-1-0. !--- Any host IP facing the the ‘inside’ interface of the ASA !--- with an address in the 192.168.1.0/24 subnet will get PAT !--- to the 10.1.5.5 address, for internet bound traffic. ASA(config)#object network OBJ_SPECIFIC_192-168-1-0 ASA(config-obj)#subnet 192.168.1.0 255.255.255.0 ASA(config-obj)#exit ASA(config)#nat (inside,outside) source dynamic OBJ_SPECIFIC_192-168-1-0 10.1.5.5 !--- The above statements are the equivalent of the nat/global !--- combination (as shown below) in v7.0(x), v7.1(x), v7.2(x), v8.0(x), !--- v8.1(x) and v8.2(x) ASA code: nat (inside) 2 192.168.1.0 255.255.255.0 global (outside) 2 10.1.5.5 |
| ASA 8.3(1) Running Config |
|---|
ASA Version 8.3(1) ! hostname ASA 1 names ! !--- Configure the outside interface. ! interface GigabitEthernet0/0 nameif outside security-level 0 ip address 10.1.5.1 255.255.255.0 !--- Configure the inside interface. ! interface GigabitEthernet0/1 nameif inside security-level 100 ip address 192.168.0.1 255.255.255.0 ! ! boot system disk0:/asa831-k8.bin ! ! object network OBJ_SPECIFIC_192-168-1-0 subnet 192.168.1.0 255.255.255.0 object network OBJ_GENERIC_ALL subnet 0.0.0.0 0.0.0.0 ! nat (inside,outside) source dynamic OBJ_GENERIC_ALL interface nat (inside,outside) source dynamic OBJ_SPECIFIC_192-168-1-0 10.1.5.5 |