Hi PK,

this question is about how to analyse which NAT statements are used and how often. (or unused). The config is quite complex and I suspect there are some NAT ways that were not intended and others that are not needed any more.

Therefore, I´d like to have a report on NAT usage, like it is available on ACL usage (counters or via some tools like Firemon).

For dynamic NAT, I get syslog data that can be filtered for the corresponding expressions, so if I count them, this gives me a (complicated) way to get the info I want. For static, I can see that NAT rules are established, but I can´t see if there is data flowing across these NATs, i.e. if they are used at all.

Since there are hundreds of static entries, permit ACLs with counters are possible, but not really something I´d like to do .

Is there any tool liek Firegen or other log analysis tool that gathers statistic data about NAT usage ?

Later,

Oliver

Hmm interesting question.

I believe just like the built dynamic translation syslog you can follow this syslog

Feb 03 2010 09:04:01: %ASA-6-302013: Built inbound TCP connection 165172 for outside:10.117.14.69/51132 (10.117.14.69/51132) to inside:192.168.2.2/5900 (172.18.254.34/5900)

305011: Built static TCP translation from inside:192.168.41.10/8501 to outside:a.b.c.d/80

This one is for static.

Grep for syslog 302013 and 305011and see how of this your firewall logs in a day.

-KS

I guess it´s time to reanimate my perl knowledge .

Right now I´m evaluating FireGen and Sawmill, since we´re on a budget we can´t spend a lot of money. Any other useful tools for syslogging PIXes and getting information out of the logdata ?

There is Cisco MARS that can do a lot with syslogs generate reports etc. But it is not free

I think you won't avoid writing perl again...

PK