Is src and dst NAT possible in multiple rules on the ASA?

Hello,
We have +/- 50 customer companies that will have to enter our network via IPsec s2s VPN's and as backup the customers have the option to enter our network via a leased line. Since they can enter multiple routes we give them a source IP depending what side they enter so we know the route back internally in the network to the correct FW they entered.
For the s2s we have to do source NAT on our side since we cannot burden all these customers with different NAT's for both the leased line and for the s2s. And we have to do destination NAT since the customers can access different DMZ systems depending on the application they connect to.
1) source NAT can be 1 NAT rule per company (so hide NAT behind 1 IP)
2) destination NAT is multiple rules (see below)
At the moment we have 12 NAT rules per company since we have configured src and dst NAT in one rule to make it work.
See example below:
Question: How can we configure src and dst NAT in multiple rules so that we dont need 12 NAT rules per company?
ASA cluster: single mode - Active/Standby
asa922-4-smp-k8.bin
asdm-731-101.bin
Src REAL
Src Mapped
Dst MAPPED
Dst REAL
Service
192.168.143.128_29
192.168.143.128_29
192.168.143.128_29
192.168.143.128_29
192.168.143.128_29
192.168.143.128_29
192.168.143.128_29
192.168.143.128_29
192.168.143.128_29
192.168.143.128_29
192.168.143.128_29
192.168.143.128_29
11.11.11.1
11.11.11.1
11.11.11.1
11.11.11.1
11.11.11.1
11.11.11.1
11.11.11.1
11.11.11.1
11.11.11.1
11.11.11.1
11.11.11.1
11.11.11.1
19.19.19.90
19.19.19.90
19.19.19.11
19.19.19.11
19.19.19.90
19.19.19.90
19.19.19.180
19.19.19.180
19.19.19.83
19.19.19.83
19.19.19.90
19.19.19.92
10.10.10.42
10.10.10.42
10.10.10.42
10.10.10.42
10.10.10.41
10.10.10.41
10.10.10.44
10.10.10.44
10.10.10.47
10.10.10.47
10.10.10.47
10.10.10.47
53-udp
53-tcp
53-udp
53-tcp
PoP3
SMTP
SMTP
PoP3
http
tcp-5555
http
http

Steve,
That is my whole point. To copy from the PC host memory to the CUDA device memory asynchronously, the host memory must be pinned. Hence, the source and destination memory should be pinned. Otherwise, I must copy the source memory to pinned memory I have allocated on the PC, copy it asynchronously to the CUDA device memory, process it on the CUDA device, asynchronously copy it back to the PC pinned memory, and then copy it to the destination memory.
If you copy synchronously, it is slow as Christmas! Therefore, you must copy the memory asynchronously, or you should not use CUDA and GPU acceleration.
My question still stands. Why is the source and destination memory on the PC used by Premiere Pro not pinned memory?
Gene
Gene A. Grindstaff
Executive Manager, SG&I
T: 1.256.730.6983 M: 1.256.566.5376 F: 1.256.730.8046
E: mailto:[email protected]
Intergraph Corporation
19 Interpro Road
Madison, AL 35758 USA
www.intergraph.com/sgi<http://www.intergraph.com/sgi> |
LinkedIn<http://www.linkedin.com/groups?gid=127267&trk=myg_ugrp_ovr> | Facebook<http://www.facebook.com/intergraph> | Twitter<http://twitter.com/intergraph

Similar Messages

CSS - src and dst in the same vlan

Hi guys,
I need LB something like this in routed mode:
first data flow:
[client]->[vip1-c(css)]->[www1/www2]
and second (backend) flow is:
[www1/www2]->[vip2-c(css)]->[www3/www4]
vip1,2-c = VIP address on client side
www1,2,3,4 = all servers are in the same VLAN
problematic is second data flow (www1/2 -> vip2 -> www3/4(because www3/4 are in the same VLAN as www1/2).
I have two solution for this:
1. migrate www1/2 and www3/4 to the independent VLANs (this can be design problem in existing topology)
2. communication from www1/2 with destination to www3/4 translate to IP address located on the CSS using group, but I'm not sure if it's possible, or how it's possible to configure on the CSS.
group gr1
add service www1
add service www2
add destination service www3
add destination service www4
vip address ip-from-client-side(for example vip2-c)
active
it's possible to use this configuration?
martin

The group is a good solution.
However, the way it was configured is incorrect.
You either specify the source or destination.
So, if you want to nat all traffic from www1 and www2 you leave the 'add server www1' commands and remove the 'add destination service www3'.
Or you can nat all traffic going to www3 and www4. In this case, you remove the 'add service www1' and keep the others.
Another way of doing this would be to remove all 'add ..' commands and use an acl to specify when to use the group using the option 'sourcegroup gr1' inside the acl.
Gilles.

Why is Src and Dst memory not pinned?

I just completed my first video filter that is CUDA accelerated using the Premiere Pro SDK for CS6 and CC7. If suitable CUDA hardware is available, it use it, but if not then it uses a multithreaded software implementation. Both work extremely well. However, the CUDA implementation could be a lot faster if the source and destination memory buffers were "pinned" memory. Since they are not, I must copy the source and destination memory to a pinned buffer, and then asynchronously copy that to CUDA device memory and back. The overhead to copy from the source/destination memory to pinned memory is significant. Without the copy to pinned memory the CUDA on my laptop is fast enought to process 130 fps for a 1920 by 1080 HD video. However with the pinned memory I only get about 45 fps.
If I do the exact same filter in DirectShow, the source and destination buffer pools are always pinned and the filter runs much faster than it does on Premiere Pro. I noticed that the new GPU filter example uses and AE interface, but it does allow access to pinned memory. However, I have not mastered the AE interface, and I am reluctant to giving up 13 years of learning curve on the Premiere SDK.
Is there any good reason why the source and destination buffer pool in the Premiere Pro SDK is not pinned memory?
Gene

Steve,
That is my whole point. To copy from the PC host memory to the CUDA device memory asynchronously, the host memory must be pinned. Hence, the source and destination memory should be pinned. Otherwise, I must copy the source memory to pinned memory I have allocated on the PC, copy it asynchronously to the CUDA device memory, process it on the CUDA device, asynchronously copy it back to the PC pinned memory, and then copy it to the destination memory.
If you copy synchronously, it is slow as Christmas! Therefore, you must copy the memory asynchronously, or you should not use CUDA and GPU acceleration.
My question still stands. Why is the source and destination memory on the PC used by Premiere Pro not pinned memory?
Gene
Gene A. Grindstaff
Executive Manager, SG&I
T: 1.256.730.6983 M: 1.256.566.5376 F: 1.256.730.8046
E: mailto:[email protected]
Intergraph Corporation
19 Interpro Road
Madison, AL 35758 USA
www.intergraph.com/sgi<http://www.intergraph.com/sgi> |
LinkedIn<http://www.linkedin.com/groups?gid=127267&trk=myg_ugrp_ovr> | Facebook<http://www.facebook.com/intergraph> | Twitter<http://twitter.com/intergraph

There is no possibility for multiple selection in the new Pages?

It used to be a great way: mark different lines by pressing the command-key and change something for all the highlighted lines. Is this really no longer possible in the new Pages? Ifeel like in the 90's...

Feature removed along with many others:
http://www.freeforum101.com/iworktipsntrick/viewforum.php?f=22&mforum=iworktipsn trick
Peter

Using both Dynamic and Static NAT with two Different Internet facing Subnets

We have two Class C Public Address subnets. We started with Subnet (A) and have many of our Internet accessible devices on it. It is running on a Cisco PIX 515R. We bought a new ASA 5510 8.3(2) and started Migrating the Users and new servers to it so I started with our second Class C Subnet (B). Later on down the road I found out that if the Firewalls Default Gateway is is set to a (B) Interface subnet, then the servers that are statically mapped to a (A) Address will have a (B) address when they communicate out to the internet. So they are receiving packets on their (A) Address, though replying to them with a (B) address.
It was mentioned that I should be able to combine static and dynamic NAT mapping to allow devices behind the firewall to have a fixed external Address when communicating outbound as well as inbound.
So For instance I want the Following: when the Internal Replies I want the reply to come from the mapped IP, not a IP from the Dynamic Pool.
Public IP: 192.168.1.100/24
Internal IP: 10.0.0.100/16
Public IP: 192.168.5.101/24
Internal IP: 10.0.0.101/16
interface Ethernet0/0
description 192.168.1.0/24 Network Outside IP
nameif outside-1
security-level 0
ip address 192.168.1.1 255.255.255.0
interface Ethernet0/1
description 192.168.5.0/24 Network Outside IP
nameif outside-5
security-level 0
ip address 192.168.5.1 255.255.255.0
interface Ethernet0/2
description inside 10.0.0.0/16
nameif inside
security-level 100
ip address 10.0.0.1 255.255.0.0
object network serverA_o
host 192.168.1.100
object network serverA_i
host 10.0.0.100
object network serverB_o
host 192.168.5.101
object network serverB_i
host 10.0.0.101
object network 192-168-1-NAT-POOL
range 192.168.1.50 192.168.1.239
nat (inside,outside-1) source static serverA_i serverA_o
nat (inside,outside-5) source static serverB_i serverB_o
nat (inside,outside-1) source dynamic any 192-168-1-NAT-POOL interface
object network serverA_i
nat (inside,outside-1) static serverA_o
object network serverB_i
nat (inside,outside-5) static serverB_o
route outside-1 0.0.0.0 0.0.0.0 192.168.1.1 1
route outside-5 0.0.0.0 0.0.0.0 192.168.5.1 2
When I set this up my serverB shows a Public IP of something in the 192-168-1-NAT-POOL Not 192.168.5.101
Any Suggestions?
Thanks!

Not sure why I have Multiple Entries. )-: I did think it was Odd. I think it might be because I looking at examples of the new and old styles of NAT.
We have a Single ISP, though have 2 separate non-Contiguous Class C Addresses from them. We host some Servers on one subnet and some on the other.
I'm looking for a way to use both Subnets on the same ASA.
The Connection to the net looks like this:
Internet -> Edge Router Layer3 VLAN Switch
GE0/1.2 - 192.168.1.1 VLAN Tagged --> GE0 - VLAN Tagged
GE0/1.2 - 192.168.5.1 VLAN Tagged -^
Layer3 VLAN Switch Firewall
GE1 192.168.1.0/24 Untagged -> ASA Outside-1
GE2 192.168.5.0/24 Untagged -> ASA Outside-5
Firewall
ASA inside 10.0.0.0/16 -> Switch -> 10.0.0.100
Hope that helps clarify.
I could try to post some sanitized Configs of my PIX and ASA if needed. But the end result I'm trying to do is have the ASA do NAT for multiple Public Subnets.

Date range to be displayed & Displaying multiple values on the report

Hi,
I have date range parameters, but I also need it to be displayed it on the report. Is there any way I can display it. E.G If a parameter is created one can drag and drop it on the report if it needs to be displayed on the report, I tried to do the same for the date range parameter but it does not work.
Also If a parameter is created by selecting the option 'Allow Multiple Values', and if you drag and drop it on the report only the first value is displayed and the rest does not show. Has anyone tried this before and been successful in displaying multiple values in the report.
Thanks in advance.

Hi,
A multi-value parameter is actually treated as an array in Crystal Reports.
To display the values selected in the parameter, create a formula from the Field Explorer and type this code:
Join({?ParameterName},",");
Place this formula on the header or the footer sections of the report.
Regarding the date range issue, please follow Sastry's advice and it should work fine.
Make sure you're using the parameter in the Minimum and Maximum functions. For eg: If I was to create a date range parameter called OrderDate, my formula to show the start date would look like this:
Minimum({?OrderDate})
-Abhilash

Searching mail shows multiple copies of the same email

I use gmail through Mail, and I noticed there are multiple copies of the same e-mail (on further inspection, it looks like the copies are at different stages/edits) show up in my Trash folder. Is there any way to stop this?

The same thing just happened in my Blackberry gmail folder... I sent an email from my computer and 20 copies showed up on my phone.

Src Addr filter and Dst Addr filter

Wht is the format/syntax of specifying IP addresses in the Src Addr filter and Dst Addr filter fileds of any signature?
Can i put a subnet, multiple subnets etc ? any syntax examples?
I can't put the $<VARIABLE> is wht i have found out.

Here are some examples:
192.168.1.1
192.168.1.0-192.168.1.255
192.168.1.0-192.168.1.255,192.168.2.0-192.168.2.255

Is it possible to search for multiple folders with the same name and...

Is it possible to search for multiple folders with the same name and then select them all and change the permissions on just those folders .i.e. Search for the budget folders in all client folders and lock them down to just the project managers. Without having to go to each folder and apply the permissions.

user11919409 wrote:
Is it possible to create a Clone database with the same name of source db using RMAN ...
yes
>
DB version is 11.2.0.2
Is it possible to clone a 11.2.0.2 database to 11.2.0.3 home location directly on a new server . If it starts in a upgrade mode , it is ok ....yes
Handle:     user11919409
Status Level:     Newbie (10)
Registered:     Dec 7, 2009
Total Posts:     102
Total Questions:     28 (22 unresolved)
why do you waste time here when you rarely get any answers to your questions?

NAT 8.6 multiple subnets in a single static NAT

Hello all, I have this question, probably pretty an easy to answer, but unfortunately I can't test it myself in a production environment right now.
Do you know if is possible to have in ASA 8.6 a Static NAT rule with multiple subnets in both object groups. I currently have one to one subnet translation, but I need to add another two subnets.
Today's configuration is this
*** FROM ONE SUBNET TO ANOTHER ***
object-group network REGIONAL-SOURCE
network-object 10.1.1.0 255.255.255.0
object-group network REGIONAL-NAT
network-object 10.1.201.0 255.255.255.0
nat (Outside,Inside) after-auto source static REGIONAL-SOURCE REGIONAL-NAT dns
What I need to accomplish is add two new subnets, but I want to see if is possible to do it using the same NAT rule, just adding the new 2 subnets.
10.1.2.0/24 natted to 10.1.202.0 255.255.255.0
10.1.3.0/24 natted to 10.1.203.0 255.255.255.0
*** TWO MORE SUBNETS ARE NEEDED ***
object-group network REGIONAL-SOURCE
network-object 10.1.2.0 255.255.255.0
network-object 10.1.3.0 255.255.255.0
object-group network REGIONAL-NAT
network-object 10.1.202.0 255.255.255.0
network-object 10.1.203.0 255.255.255.0
If this is not possible I understand separate objects should be created with individual nat, I appreciate your comments and help.

Hi,
This should be no problem. It should work as you have thought.
I tested the configurations on my own ASA
object-group network REGIONAL-SOURCE
network-object 10.1.1.0 255.255.255.0
network-object 10.1.2.0 255.255.255.0
network-object 10.1.3.0 255.255.255.0
object-group network REGIONAL-NAT
network-object 10.1.201.0 255.255.255.0
network-object 10.1.202.0 255.255.255.0
network-object 10.1.203.0 255.255.255.0
nat (LAN,WAN) source static REGIONAL-SOURCE REGIONAL-NAT
Here at the results of the "packet-tracer" to show the translations
ASA(config)# packet-tracer input LAN tcp 10.1.1.100 12345 7.7.7.7 80
Phase: 4
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (LAN,WAN) source static REGIONAL-SOURCE REGIONAL-NAT
Additional Information:
Static translate 10.1.1.100/12345 to 10.1.201.100/12345
ASA(config)# packet-tracer input LAN tcp 10.1.2.100 12345 7.7.7.7 80
Phase: 4
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (LAN,WAN) source static REGIONAL-SOURCE REGIONAL-NAT
Additional Information:
Static translate 10.1.2.100/12345 to 10.1.202.100/12345
ASA(config)# packet-tracer input LAN tcp 10.1.3.100 12345 7.7.7.7 80
Phase: 4
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (LAN,WAN) source static REGIONAL-SOURCE REGIONAL-NAT
Additional Information:
Static translate 10.1.3.100/12345 to 10.1.203.100/12345
As you can see, everything is fine
Naturally take into consideration the fact that if you were to (for some reason) remove a "network-object" statement from some "object-group" then the operation of the "nat" would change even if you entered the removed "network-object" back. (unless you removed the last "network-object" inside the "object-group") This is because the order of the "network-object" inside the "object-group" would change. You would essentially have to recreate the "object-group" and "nat" configuration.
Hope this helps
Please do remember to mark a reply as the correct answer if it answered your question.
Feel free to ask more if needed
- Jouni

Open and print multiple files from the Finder all at once.

I'm trying to research how to do this. In OS9 you used to be able to hi-lite multiple files (Word files for example) and just hit Command+P. This would automatically open all of the files AND print them.
I can't seem to do this in my OS X. Or can I? I can hi-lite and go to File/Print, but the computer is only opening but not printing.
Any suggestions??
iMac Mac OS X (10.4.8)

I don't know how to both "open and print" multiple files in one step. The ⌘O combination of course will open multiple items. The items remain selected so switching back to the "Finder" and dragging multiple icons onto the icon for "/Applications" > "Utilities" > "Printer Setup Utility.app" seems to cause them all to be printed to the default printer.
Alternatively, a user's "~/Library/Printers" folder contains printer icons -- I'm not sure what they are exactly, but they represent the printers set up for that account. They function pretty much like the pre-OS X "Desktop Printer" icons so dragging and dropping multiple files onto them should cause them to be printed. It may even be possible to create aliases to them on the "Desktop" to recreate "Desktop Printer" functionality. But again, this won't open the files into their applications.

I want to set up a home network to be able to watch my movies and litsen to music across multiple platforms without keeping my laptop connected.

I want to set up a home network to be able to watch my movies and litsen to music across multiple platforms. I have movies purchased from itunes as well as movies from my DVD collection that i converted to an .m4v format. I currently have these movies stored on an external harddrive. To watch a movie on my apple tv I have to ensure my external hard drive is connected to my macbook pro, then play the movie on my macbook pro and "mirror" it to my apple tv.
Ideally I would like to be able to watch movies from my collection without having to have my laptop on and work from that. Is it possible to navigate my collection from my Apple TV and play it on my Apple TV. My macbook pro is the machine I primarily use for work and school it is quite the protological nuissance to have to hook all that up everytime I want to watch a movie.
My thoughts are that I could take my old dekstop pc, attach an external hard drive to that and make that my "media storage". If I were to do that would I then be able to watch movies as well as select which movie I want to watch from my library through my apple TV without my macbook pro being in the equation? Or if I should desire to watch a movie from my library through my Macbook Pro, Iphone 4s, and ipad is that possible? I basically want to set up my library to be accessible from any of my devices.
My devices are; the previously mentioned Apple Tv, macbook pro, iphone 4s, ipad 3. I also have a desktop PC running windows 7, xbox 360 and playstation 3 (the xbox and PS3 would be nice if they could too but wouldnt break my heart as they are my roommate's and not mine so I rarely use them.)
Thank you for any help/advice you guys may have!

atv's can only access media from
1. a computer which is turned on running itunes
2. the internet
no other options
and NAS's which say they can work as itunes libs don't work

Can a single AE receive and deliver multiple signals at the same time?

I've looked through the forums and the AE pdf manual and have not been able to find a definitive answer so far.
We have a (all Apple) cafe in a remote location with no Apple support and we presently operate wireless music and wireless internet for customer use from one iMac and one AE. The iMac is also our cashier station. We have another iMac for customers who don't have their own laptops. The iMacs switch to screensaver displays promoting the cafe when not in use.
Our wired TV monitors that are currently not associated with our AE display either satellite TV, cable TV or from DVD player using a manually switched hub with the three separate receivers wired to the hub.
We want to add streaming TV from the internet to the TV monitors so we will have four sources. I am looking at connecting this internet streaming TV source to the TVs via AE hence I want to also allow the other TV sources to operate via AE. If possible, we would also like to switch in the screensaver from one iMac on a timed basis (or using Apple remote to one iMac) if there is nothing else of particular interest on the TVs.
The AE has multiple ports that can be expanded using hubs that we can hopefully connect the existing 3 TV sources, and can receive / transmit to multiple computers but can it operate the iTunes, internet distribution, and TV output (with switching TV inputs via the iMac & AE Utility) at the same time or do we need multiple AEs and another computer?

The AE has multiple ports that can be expanded using hubs that we can hopefully connect the existing 3 TV sources, and can receive / transmit to multiple computers but can it operate the iTunes, internet distribution, and TV output (with switching TV inputs via the iMac & AE Utility) at the same time or do we need multiple AEs and another computer?
The AirPort Extreme base station (AEBS) does not have a TV or video output.
The AEBS, just like any other router, supports multiple clients simultaneously. Of course there is always bandwidth limitations for any device. So in theory the AEBS can support all of that. In reality the performance of each service will depend on the bandwidth used by each and the bandwidth available. This is no different than any router.

Is it possible for multiple users to use a "generic" account simultaneously without screen sharing?

Hey and thanks for checking out the thread.
I am wondering if it is possible to have users use a generic account at the same time without any sort of screen sharing.
I have set up a generic user account (for example useraccount, password 1234) for users to use in the time before I can set up a custom user name for them. However, I have run into some issues with this.
When multiple users log on using this generic account, their applications seem to be shared on each screen. In the room with multiple Mac workstations, if someone starts working on Photoshop, Photoshop will open on every one elses screen who is logged on under that generic account.
Is it possible for users to log on using a generic network account and have their own isolated work environment or is this sort of sharing a feature? I am new to Mac servers and am not sure.
Thanks for reading the thread.

That shared-account approach seems impractical for the various reasons you've identified, as well as the inevitable issue of cleaning up the detritus that'll inevitably build up in a shared account, and for the lack of accountability for activities occuring under the shared account for both auditing and security, and sharing directories would tend to introduce obscure conflicts around which-file-version-wins file updates when the same file is used in several places, and would probably be contrary to any per-user application software licensing agreements that might be involved.
Put another way, get unique accounts created for folks, and work toward the ability to create accounts for arriving folks, and — if it's applicable here — talk to management about getting any per-user software licensing issues sorted out, whether that's having spare copies purchased and ahead or some advanced notice on accounts, or establishing group software licensing where that's available.
AFAIK, there are tools around which can automate account creation, too. Either generic, a tool such as Passenger, or it's certainly feasible to script the account creation sequence.
Trying this shared-access generic-account approach just looks like it can create more work and more hassles and more effort to me...

How to do a NAT to multiple MACs via the same public IP

Heay y'all,
I have multiple MACs that I need to admin via the same public IP.
I'm trying to activate the NAT function on my airport 802.11n, but I can only register 1 internal IP address for the same port number.
Example:
public UDP port: 3283, 5900
public TCP port: 3283, 5900
Private IP Address: 10.0.1.201
Private UDP port: 3283, 5900
Private TCP port: 3283, 5900
Now if I try to do the same thing for another private address, I get a a conflict... (The Port mapping entry you have entered already exists.)
What I find wired is that:
a) why the private address starts at xxx.xxx.xxx.201
b) why can't I apply the same rule for multiple IPs (e.g. xxx.xxx.xxx.202 and xxx.xxx.xxx.203)
c) I have also, an airport 802.11g and I could configure the NAT table as I wanted.
Am I missing something?
Are three any wild-cards that would cover all internal IP addresses?
PS! I edited my ".baseconfig" file via "textedit" and added a additional private IP address, in the NAT section... I have not gotten any errors, when I load the file in to the base station. but then again I can't edit the IP field via the airport admin tool, and I have not been able to test this workaround.
looking forward to you comments.

Hi guys,
Thanks for the help....
I think i found an alternative solution...
I'll try useing a dedicated internal IP address for my adminwork... then I'll get the user to change from the DHCP allocated IP address to the dedicated one... this way same ports and IP address used for all of the machines.
I'll try this method... if it does not work then I have to use your suggestions... but thanks for your help and response.
www.gekko-systems.com

Is src and dst NAT possible in multiple rules on the ASA?

Similar Messages

Maybe you are looking for