NAT/PAT Configuration – How to NAT Two Internal Subnets to One WAN IP on ASA

cisco-asanat;

I have a working configuration on two Juniper Netscreen devices that I'm trying to replicate on an ASA 5505. Here's the scenario:

+-----+   77.77.77.77   +-----+ 10.20.0.0/24 *******
| WAN | =============== | ASA | ------------ * DMZ *
+-----+                 +-----+    VLAN 20   *******
                           |
                           |  10.30.0.0/24   ***********
                           +---------------- * Clients *
                                VLAN 30      ***********

I'm trying to perform PAT on both internal subnets (i.e. so all internal clients can access the internet). However, when I try to configure the NAT rules using ASDM, it says that there's a PAT range overlap. There must be some way to configure the NAT rules such that both zones/subnets can share an external PAT IP (just like in ScreenOS), but I haven't found it yet.

Unfortunately, ordering extra external IPs isn't an option at the moment, so I hope there's a way to do this without purchasing any more gear.

Best Answer

I think that should do it:

  object-group FOO
    network-object 10.30.0.0 255.255.255.0
    network-object 10.20.0.0 255.255.255.0

  object network BAR
    host 77.77.77.77

  nat (inside,any) source dynamic FOO BAR
Related Topic