So I've inherited a Cisco ASA 5505, and I have no experience whatsoever with the things! There are two Network Interfaces both WAN facing, and the LAN interface of course. Now in NAT rules, there are two rules:

Match Criteria: Original Packet                           Action Translated Packet: 
  SourceInt  DesInt        Source  Destination  Service   Source       Destination Service        
3  inside    Outside-ISP1  obj_Any    any        any      Outside-ISP1   original    original
4  inside    Outside-ISP2  obj_Any2   any        any      Outside-ISP2   original    original

If I remove either of these NATs, no one can access anything outside of the LAN on the said interface I removed the NAT rule from. What is this rule doing?


Not wanting to sound patronising, you should verify your understand of NAT;

Clients on the LAN likely have a private IP addresses (from RFC1918) that are not routable across the Internet. The two WAN interfaces likely have public routable IP addresses allocated from the two ISPs they are connected too.

When a host on the LAN connects to a host on the Internet such as a web server, it makes the request to the ASA, and the ASA passes on the request to the remote Internet host but translates the IP address of the LAN host within the request, to one of its public IP addresses. If the ASA sends the request via the first WAN interface the ASA will change the source IP of the request to the IP assigned of the first WAN interface;

 Action Translated Packet: 

If the request is sent via the second WAN interface it uses the other rule, Outside-ISP2 and the request is modified to use the source IP of the second WAN interface, instead of the LANs internal private IP address.

If you drop either of these NAT rules, the LAN host addresses aren't translated into a public routable address and the request sent to the website and will not be answered, because the website can't communicate back to a host on a private IP address, it won't know where it is or how to get there across the Internet.

As both the rules are seemingly the same, just looking at the first one:

  SourceInt  DesInt        Source  Destination  Service   Source       Destination Service        
3  inside    Outside-ISP1  obj_Any    any        any      Outside-ISP1   original    original

This rule is saysing "Any traffic that comes into the interface called inside (which is likely going to be the LAN interface), which is destined for the interface called Outside-ISP1 (which is likely going to be the 1st WAN interface, also it will be going there probably because of a default route on the ASA), that comes from the source IP matching those in obj_Any (which likely matches any inside LAN host IP) looking to reach a Destination of any and through a Service of any; Will have it's source IP changed to Outside-ISP1 (the IP of the WAN1 interface) and the Destination left as is, and the Service left as is.

These extra option for matching traffic based on destination and service, can be used for other kinds of NAT rules such as port redirection or policy based routing.


You're playing around with the config during production hours? :)

It's performing NAT translation...changing the source address of the client initiating the traffic to the source IP of the outside interface (Outside-ISP1 or Outside-ISP2 depending on which NAT rule it hits).

It's saying:

If the source is an object in the "obj_Any" list and the destination is ANY destination on ANY service/port THEN the new source IP is the IP of the Outside-ISP1 interface and the destination IP and service/port remain the original/unchanged.

You need to read up on NAT basically...what it is, why it exists, etc. It's more complex than that simple explanation (NAT tables, NAT/PAT, etc. etc.)

  • Okay, thanks, that is what I thought, but we had to add the 2nd NAT rule (number 4) for the Outside-ISP2 line to work, do Cisco's not create the NAT rules automatically? – PnP Jun 19 '13 at 18:44
  • There are some defaults if you load up a default config on the ASA, yes, but it won't know that you want two different source NAT rules by default. – TheCleaner Jun 19 '13 at 18:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.