nat config oin asa 5510

kenny504

Ok i need some help I'm new to the asa world but i want to know if this config would work or not.

here's the scenario,

local net (192.168.50.0/24)

---

>ASA 5510 (inside 192.168.50.1/24) | (outside 192.168.222.14/30)

---

> ISP MPLS (192.168.222.13/30)

---

> internet cloud

the isp has assigned 192.168.222.13 as our next hop and also given us a block of public address e.g 1.1.1.2 - 1.1.1.9. we will just overload 1.1.1.2 for clients to use for now.

here's is my nat commands, havent woked on this thing since the pix days so let me know if im missing something

config# global (outside) 1 1.1.1.2
config# nat (inside) 1 0.0.0.0 0.0.0.0
config# route outside 0.0.0.0 0.0.0.0 192.168.222.13 1

with this scenario on an asa5510 i should not need any access-list command for clients on the 192.168.50.1 subnet to ping internet hosts right?

mikearama

I'm unclear how you plan to use the 1.1.1.2 - 9 range on an ASA that has 192.168.222.14 as its outside IP address, and a default gateway of 222.13. You don't have access to the 1.1.1.2 - 9 interface on the ISP's CE router... so you don't get to control the public NAT's.

Since you have access to your 5510 with the 222.14 interface, I believe you only get to control the PAT on that interface. In which case, your global is something like:
config#global (outside) 1 interface
or
config#global (outside) 1 192.168.222.14

If I'm right, you get to notify your ISP how you want them to NAT your public IP's.

Ahriakin

It can work as originally stated, it'd be a little bit odd though but they can NAT on their own devices so long as the Provider has statics pointing to their ASA as the gateway for those addresses (once the ASA has xlations in place for the traffic it will accept it even though those public addresses are not a part of it's Outside subnet). As for the ICMP question first up enable ICMP inspection (and ICMP error for handyness) under your global policy so you can statefully allow replies to your hosts. So long as you are allowing this traffic on your ingress/inside (i.e. no ACL or you have an explicit permit in that ACL) then you should be good to go.

policy-map global_policy
class inspection_default
inspect icmp
inspect icmp error