ASA 8.2(1) Global and NAT statements, natting certain internal hosts

Question

Hi, I have what I believe will be an easy question, but I cannot find the answer and cannot afford to test it on our production ASA.
I am running an ASA firewall, we are performing PAT with one Public IP Address for all inside traffic accessing the Internet.  We need to implement a solution where whenever two or three internal hosts/servers access the Internet, they need to appear to come from a unique public IP, different than the current Global IP for all other internal traffic.  I understand I could Nat thier Internal IP Address to a public IP, but I don't need each server to have it's own public IP, I'd like for all of them to share one.
Thoughts on how to accomplish this?  Thanks!

Answer 1

Hi,
To my understanding you would just create a new Dynamic PAT configuration using different NAT ID for these hosts.
Though when you create a separate Dynamic PAT for some hosts with a new NAT ID you will have to make sure that this NAT ID has a rule towards any interface they had before.
In a very basic setup there should only be Dynamic PAT between your "inside" and "outside" interfaces (presumed thats what they are called on your firewall)
This would mean that if you had for example a network 10.10.10.0/24 and you performed Dynamic PAT for that network using the "outside" interface IP address you would then configure the following
global (outside) 1 interface
nat (inside) 1 10.10.10.0 255.255.255.0
So the above is probably the type of configuration you have at the moment?
For the 2/3 hosts you have that need a different PAT IP address you could probably configure something like this (1.1.1.1 is just an example IP instead of the actual public IP address that is different from the interface IP address)
global (outside) 2 1.1.1.1
nat (inside) 2 10.10.10.1
nat (inside) 2 10.10.10.2
nat (inside) 2 10.10.10.3
If the original ID 1 NAT rule had "global" statements for some other interface then you would most likely need ID 2 configurations for those too. Though generally Dynamic PAT is only performed towards other external networks which usually means only the "outside" interface.
Without seeing the configurations I dont think I can say much more.
Naturally "packet-tracer" is an excellent command to confirm what what NAT/PAT is applied for a hosts connection.
For example if you wanted to test host 10.10.10.1 applied ASA configurations/rules towards some external hosts you could issue this command
packet-tracer input inside udp 10.10.10.1 12345 8.8.8.8 53
This should tell you what NAT translation is performed for this traffic (it simulates a destination port UDP/53 connection towards 8.8.8.8). Naturally you can also confirm things through firewall logs and the translation table of the device.
Active translations on the firewall you can show with the command
show xlate
It does have a lot of additional parameters after the "xlate" if you want to have more specific output
Hope this helps
Please do remember to mark a reply as the correct answer if it answered your question.
Feel free to ask more if needed
- Jouni