Cisco Systems ASA 5555-X, ASA 5505, ASA 5545-X manual NAT and VPN Management Access, Subnet 10.2.2.0

Chapter 3 Information About NAT

NAT for VPN

object network vpn_local

subnet 10.3.3.0 255.255.255.0

nat (outside,outside) dynamic interface

! Identify inside Boulder network, & perform object interface PAT when going to Internet:

object network boulder_inside

subnet 10.1.1.0 255.255.255.0

nat (inside,outside) dynamic interface

!Identify inside San Jose network for use in twice NAT rule: object network sanjose_inside

subnet 10.2.2.0 255.255.255.0

!Use twice NAT to pass traffic between the Boulder network and the VPN client without

!address translation (identity NAT):

nat (inside,outside) source static boulder_inside boulder_inside destination static vpn_local vpn_local

!Use twice NAT to pass traffic between the Boulder network and San Jose without

!address translation (identity NAT):

nat (inside,outside) source static boulder_inside boulder_inside destination static

sanjose_inside sanjose_inside

!Use twice NAT to pass traffic between the VPN client and San Jose without

!address translation (identity NAT):

nat (outside,outside) source static vpn_local vpn_local destination static sanjose_inside sanjose_inside

See the following sample NAT configuration for ASA2 (San Jose):

! Identify inside San Jose network, & perform object interface PAT when going to Internet:

object network sanjose_inside subnet 10.2.2.0 255.255.255.0

nat (inside,outside) dynamic interface

! Identify inside Boulder network for use in twice NAT rule:

object network boulder_inside

subnet 10.1.1.0 255.255.255.0

! Identify local VPN network for use in twice NAT rule:

object network vpn_local

subnet 10.3.3.0 255.255.255.0

!Use twice NAT to pass traffic between the San Jose network and Boulder without

!address translation (identity NAT):

nat (inside,outside) source static sanjose_inside sanjose_inside destination static

boulder_inside boulder_inside

!Use twice NAT to pass traffic between the San Jose network and the VPN client without

!address translation (identity NAT):

nat (inside,outside) source static sanjose_inside sanjose_inside destination static

vpn_local vpn_local

NAT and VPN Management Access

When using VPN, you can allow management access to an interface other than the one from which you entered the ASA (see the management-accesscommand). For example, if you enter the ASA from the outside interface, the management-access feature lets you connect to the inside interface using ASDM, SSH, Telnet, or SNMP; or you can ping the inside interface.

Cisco ASA Series Firewall CLI Configuration Guide

3-26