ASA NAT/PAT (exemption)

Security ASA
1

Hi,

Lets assume that I have another OUTSIDE zone and there is a gsm router (which is already doing nat ).So I dont’ want to NAT whatever going throuth this zone .

How can I do that

Thanks

2

@siraj.malayil It can be done like this:

nat (LOCAL_SUBNET,OUTSIDE) source static LOCAL_SUBNET LOCAL_SUBNET destination static REMOTE_SUBNET REMOTE_SUBNET

object network LOCAL_SUBNET
 subnet 192.168.1.0 255.255.255.0

object network REMOTE_SUBNET
 subnet 192.168.2.0 255.255.255.0

This tells the ASA that traffic from the LOCAL_SUBNET, going to the OUTSIDE should be translated “to itself”. In other words, don’t translate it. Same thing for the REMOTE_SUBNET.

1 Like
4

For a complete example, take a look here: