How to configure Static NAT on Cisco IOS Router

[lagapidis (Lazarus Agapidis)]

Hello AZM

@azmuddincisco

1. Let’s say one of the internal hosts 10.0.0.1 is being natted to 172.16.0.10 on ASA0. When the edge switch sends out an ARP request to get the mac address of 172.168.0.10 IP address, how would ASA0 know it has to respond to the ARP request even though the IP is not attached to any interface? Why would ASA1 not respond to the same ARP request?

The ARP request would come from the 3560 router saying “I need the MAC address of the device which has an IP address of 172.16.0.10.” Because ASA0 is configured with the specific NAT configurations, it knows that it must respond to any ARP requests for addresses in the range of 172.16.0.4 to 172.16.0.100. Similarly, ASA1 knows that it is responsible to answer any ARP requests for addresses in the range of 172.16.0.101 to 172.16.0.200. When ASA1 gets the ARP request, it will discard it, while ASA0 will take it and answer with the appropriate MAC address.

@azmuddincisco

2. Can ASA0 and ASA1 both use the same IP address (for instance 172.16.0.10) as a NATTED IP for the internal hosts located behind them on different ports? [for instance, in ASA0 some internal IPs(10.0.0.1-10.0.010) are taking traffic on 172.16.0.10 on port 80 and in ASA1 some internal IPs(10.10.0.1-10.10.0.10) are taking traffic on the same IP 172.16.0.10 on port 443] ?

No, this is not possible. If you configured both ASAs to NAT the same external IP address, for example, 172.16.0.10, then any ARP request coming from the 3560 for this IP address would be responded to by both ASAs. You would essentially have an IP address conflict on the subnet. In order to have this work, the two ASAs must be differentiated based on Port Number, something that cannot be achieved on layers 2 and 3.

I hope this has been helpful!

Laz