Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an ASA 5505 running 8.4 with its outside interface plugged into our internal network. I want to open up access to hosts on one of the vlans behind that ASA to hosts on our internal network. I was just starting to grasp NAT on our older PIX but the ASA 8.4 has me confused now. Given a clean ASA with an outside vlan of 10.0.0.1/24 and test vlan of 10.0.1.1/24 what's the basic configuration needed to allow any hosts on the outside network to have access to any of the hosts on the test network?

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

Have you already configured the ACLs too? If you've defined your 10.0.0.0/24 network as outside (default interface security level 0), it will not allow traffic to the other interfaces.

What about your objects - have you defined those? You should really be using object references, rather than IPs when using ASA 8.4.

As far as NAT goes, if you just want to NoNAT everything (everybody keeps their IPs), you would do:

nat (outside,inside) source static myOutsideSubnet myOutsideSubnet IP destination static myInsideSubnet myInsideSubnet

That is the "twice-NAT" method of NAT'ing on 8.4. Sounds weird to you, if you're new to 8.4. Twice-NAT just means that you define two rules for NAT, one in each direction. It is not obvious, but by default, all rules are bidirectional, so the one statement above also created the reverse NAT rule, for traffic going (inside,outside). If you use the ASDM for this, you would see a checkbox for bidirectional when you're creating the NAT, and you would see both rules appear in the console.

There is also object-NAT. Consult the 8.4 docs for syntax and examples of them:

Twice-NAT

Object-NAT

share|improve this answer
    
Thanks. I did figure this out on my own but it is the correct answer. –  fwrawx Nov 12 '12 at 21:11
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.