ASA - NAT based on destination address

Discussion in 'Hardware' started by tomasek, Nov 29, 2007.

  1. tomasek

    tomasek

    Joined:
    Nov 29, 2007
    Messages:
    2
    Likes Received:
    0
    Hi,

    how to configure source address NAT based on destination address in Cisco ASA 5510?

    source host address 192.168.11.1 accessing 10.1.1.0 255.255.255.0 network (192.168.11.1 to be translated to 172.16.1.1)

    source host address 192.168.11.1 accessing all networks except of 10.1.1.0 255.255.255.0 (192.168.11.1 to be translated to 60.60.60.60)


    this is what i tried to configure.

    access-list privataccess extended permit ip host 192.168.11.1 10.1.1.0 255.255.255.0

    access-list publicaccess extended deny ip host 192.168.11.1 10.1.1.0 255.255.255.0
    access-list publicaccess extended permit ip host 192.168.11.1 any

    nat (inside) 1 access-list privataccess outside
    nat (inside) 2 access-list publicaccess outside
    global (outside) 2 60.60.60.60 netmask 255.255.255.255
    global (outside) 1 ISR_WebProdNat netmask 255.255.255.255
    static (inside,outside) 60.60.60.60 access-list publicaccess
    static (inside,outside) 172.16.1.1 access-list privataccess


    but I get a message "Deny rules not supported in Policy Nat" and "access-list has deny statements". What am I doing wrong?

    Thanks for your help

    Tomas.
     
    Last edited: Nov 30, 2007
    tomasek, Nov 29, 2007
    #1
    1. Advertisements

  2. tomasek

    Greeley

    Joined:
    Dec 16, 2007
    Messages:
    67
    Likes Received:
    0
    Take out this ACL:

    access-list publicaccess extended deny ip host 192.168.11.1 10.1.1.0 255.255.255.0

    As long as the privateaccess ACL comes first when the source and destination is matched it will automagically go there all else is denied. when the next nat translation is hit and goes to the privateaccess acl then the remaining source to any host will be proocessed.

    Hope this help,

    --G
     
    Greeley, Dec 16, 2007
    #2
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.