ASA Static one to one NAT on a range of addresses
It is possible to implement static Network Address Translation (NAT) on a range of IP addresses on a Cisco ASA rather than on a single IP address. This can be achieved by defining a whole subnet when implementing NAT.
The following is an example of how this can be achieved:
ASA1(config)# object network PUBLIC_POOL ASA1(config-network-object)# subnet 10.10.10.0 255.255.255.0
First we configure the pool with IP addresses. Our next step is to create a network object for the DMZ subnet and to enable NAT:
ASA1(config)# object network DMZ ASA1(config-network-object)# subnet 192.168.1.0 255.255.255.0 ASA1(config-network-object)# nat (DMZ,OUTSIDE) static PUBLIC_POOL
The configuration above tells the ASA to translate any IP address from the subnet DMZ (192.168.1.0 /24) to an IP address in the PUBLIC_POOL (10.10.10.0 /24).
Last but not least, let’s make the access-list:
ASA1(config)# access-list OUTSIDE_TO_DMZ permit tcp any 192.168.1.0 255.255.255.0
and activate it on the outside:
ASA1(config)# access-group OUTSIDE_TO_DMZ in interface OUTSIDE
Such a configuration will result in the translation of addresses such that the last octet is always the same. For example:
10.10.10.1 --> 192.168.1.1 10.10.10.3 --> 192.168.1.3 10.10.10.200 --> 192.168.1.200 and so on.
Links:
https://forum.networklessons.com/t/cisco-asa-site-to-site-ikev1-ipsec-vpn/825/117?u=lagapides