1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Double NAT or IP Route NAT Question

Discussion in 'Design' started by craigie, Aug 13, 2010.

  1. craigie

    craigie Terabyte Poster

    3,020
    173
    155
    I'm currently putting together the design for a 6 Cisco ASA 5510's operating in a Three Tier Active/Passive Failover.

    The client is required to have this as part of there overall IT strategy, what I'm not sure about is whether to use a Double NAT or IP Route NAT as I don't want any dramas in the future if we need to create site to site VPN's.

    Double NAT

    200.200.200.3 > 192.168.100.250 > 10.50.50.1

    IP Route NAT

    IP Route 200.200.200.3 255.255.255.240 192.168.100.250 then NAT 10.50.50.1

    If anyone has done either before and can let me know the pitfalls of either, that would be appreciated.

    [​IMG]
     
    Certifications: CCA | CCENT | CCNA | CCNA:S | HP APC | HP ASE | ITILv3 | MCP | MCDST | MCITP: EA | MCTS:Vista | MCTS:Exch '07 | MCSA 2003 | MCSA:M 2003 | MCSA 2008 | MCSE | VCP5-DT | VCP4-DCV | VCP5-DCV | VCAP5-DCA | VCAP5-DCD | VMTSP | VTSP 4 | VTSP 5
  2. greenbrucelee
    Highly Decorated Member Award

    greenbrucelee Zettabyte Poster

    14,283
    254
    329
    I'm no expert but why not implement the easiest to do? because as far as I understand things NAT wont be needed once IPv6 comes into the main and that wont be too long away.
     
    Certifications: A+, N+, MCDST, Security+, 70-270
    WIP: 70-620 or 70-680?
  3. LukeP

    LukeP Gigabyte Poster

    1,194
    41
    90
    I don't think it's as easy as that. NAT plays important part on network security IMHO as well as there is plenty of software that just will not work in pure IPv6 environment (Exchange 2010 for example) that will be around for many years to come.
     
    WIP: Uhmm... not sure
  4. greenbrucelee
    Highly Decorated Member Award

    greenbrucelee Zettabyte Poster

    14,283
    254
    329
    wont there be hot fixes to counter that though?
     
    Certifications: A+, N+, MCDST, Security+, 70-270
    WIP: 70-620 or 70-680?
  5. LukeP

    LukeP Gigabyte Poster

    1,194
    41
    90
    For Exchange? Maybe, maybe not. Maybe MS will try to push new version out to customers.
    Still, I can't see IPv4 going any time soon.
     
    WIP: Uhmm... not sure
  6. danielno8

    danielno8 Gigabyte Poster

    1,305
    48
    92
    IPv6 will not be in corporate networks for a long time. To be honest i don't see it being needed AT ALL on the inside of a network the way things are currently.
     
    Certifications: CCENT, CCNA
    WIP: CCNP
  7. danielno8

    danielno8 Gigabyte Poster

    1,305
    48
    92
    Craigie, that's going to be a nightmare to manage, i don't envy you haha.

    Do you have to do it through so many different F/w? We have a similar set up using a HA pair of checkpoints.
     
    Certifications: CCENT, CCNA
    WIP: CCNP
  8. greenbrucelee
    Highly Decorated Member Award

    greenbrucelee Zettabyte Poster

    14,283
    254
    329
    New version more likely

    Maybe, but from what I can see is IPv6 will erradicate IPv4 on all fronts.

    To answer Cragies point we do IP routing where I am seems like the best method.
     
    Certifications: A+, N+, MCDST, Security+, 70-270
    WIP: 70-620 or 70-680?
  9. craigie

    craigie Terabyte Poster

    3,020
    173
    155
    Good idea mate, but lots of legacy apps which need ipv4.
     
    Certifications: CCA | CCENT | CCNA | CCNA:S | HP APC | HP ASE | ITILv3 | MCP | MCDST | MCITP: EA | MCTS:Vista | MCTS:Exch '07 | MCSA 2003 | MCSA:M 2003 | MCSA 2008 | MCSE | VCP5-DT | VCP4-DCV | VCP5-DCV | VCAP5-DCA | VCAP5-DCD | VMTSP | VTSP 4 | VTSP 5
  10. craigie

    craigie Terabyte Poster

    3,020
    173
    155
    Our client is a subsiduary of a major UK bank and therefore we have to meet there requirements.

    We have installed a few ASAs in HA, but never in a 3 tier system, hence my concerns about NAT.
     
    Certifications: CCA | CCENT | CCNA | CCNA:S | HP APC | HP ASE | ITILv3 | MCP | MCDST | MCITP: EA | MCTS:Vista | MCTS:Exch '07 | MCSA 2003 | MCSA:M 2003 | MCSA 2008 | MCSE | VCP5-DT | VCP4-DCV | VCP5-DCV | VCAP5-DCA | VCAP5-DCD | VMTSP | VTSP 4 | VTSP 5
  11. craigie

    craigie Terabyte Poster

    3,020
    173
    155
    Thanks mate, will give that a whirl and see what happens
     
    Certifications: CCA | CCENT | CCNA | CCNA:S | HP APC | HP ASE | ITILv3 | MCP | MCDST | MCITP: EA | MCTS:Vista | MCTS:Exch '07 | MCSA 2003 | MCSA:M 2003 | MCSA 2008 | MCSE | VCP5-DT | VCP4-DCV | VCP5-DCV | VCAP5-DCA | VCAP5-DCD | VMTSP | VTSP 4 | VTSP 5
  12. BosonMichael
    Highly Decorated Member Award

    BosonMichael Yottabyte Poster

    19,136
    462
    374
    I seriously doubt IPv4 will be going away anytime soon.
     
    Certifications: CISSP, MCSE+I, MCSE: Security, MCSE: Messaging, MCDST, MCDBA, MCTS, OCP, CCNP, CCDP, CCNA Security, CCNA Voice, CNE, SCSA, Security+, Linux+, Server+, Network+, A+
    WIP: Just about everything!
  13. zebulebu

    zebulebu Terabyte Poster

    3,748
    330
    187
    ^^ This ^^

    It's already being used by ISPs, but there's precious little need for ANY SME to EVER use IPv6 in the current situation. It's an absolute PITA to manage compared to IPv4 for one thing. I see a situation developing in the next ten years where the only time you'll ever need it will be at the border of your enterprise connecting to your ISP - internal to external everything will just tunnel through.
     
    Certifications: A few
    WIP: None - f*** 'em
  14. Theprof

    Theprof Petabyte Poster Forum Leader

    4,570
    68
    196
    I personally wouldn't go with a double NAT route... you might end up with a nightmare when network address translation errors arise... If it's for security reason why not use a proxy such as an ISA server?
     
    Certifications: A+ | CCA | CCAA | Network+ | MCDST | MCSA | MCP (270, 271, 272, 290, 291) | MCTS (70-662, 70-663) | MCITP:EMA | VCA-DCV/Cloud/WM | VTSP | VCP5-DT | VCP5-DCV
    WIP: VCAP5-DCA/DCD | EMCCA
  15. LukeP

    LukeP Gigabyte Poster

    1,194
    41
    90
    *cough*Forefront Threat Management Gateway*cough*

    Only kidding mate. But I agree double NAT is asking for problems.*

    * Based on horror stories I've seen on Internet
     
    Last edited: Aug 16, 2010
    WIP: Uhmm... not sure
  16. Theprof

    Theprof Petabyte Poster Forum Leader

    4,570
    68
    196

    LOL! just did my research and realized that Forefront Threat Management Gateway is the new ISA... I know ISA can become a paint too.. we have it at work, I believe its 2004 version. However everywhere I used it, it worked well for what I needed it to do...
     
    Certifications: A+ | CCA | CCAA | Network+ | MCDST | MCSA | MCP (270, 271, 272, 290, 291) | MCTS (70-662, 70-663) | MCITP:EMA | VCA-DCV/Cloud/WM | VTSP | VCP5-DT | VCP5-DCV
    WIP: VCAP5-DCA/DCD | EMCCA

Share This Page

Loading...