EasyManuals Logo

Cisco ASA 5512-X Cli Configuration Guide

Cisco ASA 5512-X
2164 pages
To Next Page IconTo Next Page
To Next Page IconTo Next Page
To Previous Page IconTo Previous Page
To Previous Page IconTo Previous Page
Page #773 background imageLoading...
Page #773 background image
1-27
Cisco ASA Series CLI Configuration Guide
Chapter 1 Information About NAT
NAT for VPN
Figure 1-21 shows a VPN client Telnetting to the ASA inside interface. When you use a
management-access interface, and you configure identity NAT according to the “NAT and Remote
Access VPN” or “NAT and Site-to-Site VPN” section, you must configure NAT with the route lookup
option. Without route lookup, the ASA sends traffic out the interface specified in the NAT command,
regardless of what the routing table says; in the below example, the egress interface is the inside
interface. You do not want the ASA to send the management traffic out to the inside network; it will never
return to the inside interface IP address. The route lookup option lets the ASA send the traffic directly
to the inside interface IP address instead of to the inside network. For traffic from the VPN client to a
host on the inside network, the route lookup option will still result in the correct egress interface (inside),
so normal traffic flow is not affected. See the “Determining the Egress Interface” section on page 1-22
for more information about the route lookup option.
Figure 1-21 VPN Management Access
See the following sample NAT configuration for the above network:
! Enable hairpin for non-split-tunneled VPN client traffic:
same-security-traffic permit intra-interface
! Enable management access on inside ifc:
management-access inside
! Identify local VPN network, & perform object interface PAT when going to Internet:
object network vpn_local
subnet 10.3.3.0 255.255.255.0
nat (outside,outside) dynamic interface
! Identify inside network, & perform object interface PAT when going to Internet:
object network inside_nw
subnet 10.1.1.0 255.255.255.0
nat (inside,outside) dynamic interface
VPN Client
209.165.201.10
Internet
Inside
1. Telnet request to ASA inside ifc;
management-access config req’d
4. Telnet request to 10.1.1.1
2. ASA decrypts packet; src address is now local address
Dst: 10.3.3.10 209.165.201.10
7. ASA encrypts packet; dst address is now real address
10.3.3.10
Src: 209.165.201.10
8. Telnet response to
VPN Client
Dst: 209.165.201.10
Dst: 10.3.3.10
10.1.1.1
Src: 10.1.1.1
10.3.3.10
3. Identity NAT between inside &
VPN client NWs; route-lookup req’d
Src: 10.3.3.10
10.1.1.1
Dst: 10.1.1.1
10.3.3.10209.165.201.10
ASA Inside IP:10.1.1.1
5. Telnet response
to VPN Client
Dst: 10.3.3.10
6. Identity NAT
Src: 10.3.3.10
303461

Table of Contents

Other manuals for Cisco ASA 5512-X

Questions and Answers:

Question and Answer IconNeed help?

Do you have a question about the Cisco ASA 5512-X and is the answer not in the manual?

Cisco ASA 5512-X Specifications

General IconGeneral
Firewall Throughput1.2 Gbps
VPN Throughput200 Mbps
Maximum VPN Peers250
Integrated IPSYes
IPS Throughput250 Mbps
RAM4 GB
Power SupplyAC, 100-240V
Security Contexts2 (Standard), 50 (with Security Contexts license)
Interfaces6 x Gigabit Ethernet
Dimensions (H x W x D)1.75 x 17.5 x 14.5 inches
Weight16 lbs

Related product manuals