help with new NAT config

Unanswered Question
Feb 22nd, 2012
User Badges:

I'm struggling to get my NAT working as I am upgrading from a PIX to an ASA running 8.4. I'm trying to duplicate the following that was taken from the PIX:


PIX NAT shown here:

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

global (outside) 1 interface

global (outside) 1 x.x.x.x


On the ASA, I did the following:

object network obj_any
subnet 0.0.0.0 0.0.0.0
nat (inside,outside) dynamic interface

And then I added the command below and it overrode my first command

nat (inside,outside) dynamic x.x.x.x

I'm not quite sure how to get it to PAT to the interface, and also use a specific IP for a backup overload. In any case, I tried to remove the last nat that was applied and got this error:

FW(config)# no nat (inside,outside) dynamic x.x.x.x

no nat (inside,outside) dynamic x.x.x.x
                        ^
ERROR: % Invalid input detected at '^' marker.

I can't seem to remove this NAT. When I try to put my first NAT back in place, I get:

FW(config)# nat (inside,outside) dynamic interface
                                                         ^
ERROR: % Invalid input detected at '^' marker.


what am I doing wrong here? If I can't specify both and interface and an ip for the NAT, I can live with that. However, I prefer I use the interface rather than the specific ip if I can only use one. But I can't seem to get it removed. I don't dare use the "clear configure nat" command as I have a whole bunch of static NAT in place that I don't want to have to re-enter.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Marvin Rhoads Wed, 02/22/2012 - 09:56
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,
  • Cisco Designated VIP,

    2017 Firewalling, Network Management, VPN

I believe your inability to use the "no..." command is because you are trying to remove an object NAT rule. You need to enter that command from within the network object configuration mode (as oppposed to the global mode). Reference


So go back into config mode, then enter the command "object network obj_any". You should have a prompt that looks something like:


     hostname(config-network-object)#


Then you should be able to do the "no nat... " command.

matthewatt Wed, 02/22/2012 - 10:14
User Badges:

Thanks for that. I knew it had to be something simple I was missing!


Does anyone know if you can continue to put in a nat statement on the new code that will give me the same as the following does on a PIX?


nat (inside) 1 0.0.0.0 0.0.0.0 0 0

global (outside) 1 interface

global (outside) 1 x.x.x.x

Julio Carvajal Wed, 02/22/2012 - 10:25
User Badges:
  • Purple, 4500 points or more

Yes, You can


It will be


nat (inside,outside) source dynamic any interface


Regards,


Do rate helpful posts.


Julio

matthewatt Thu, 02/23/2012 - 05:52
User Badges:

I don't understand how that gives me the ability to PAT to the interface as well as a separate IP address, defined as x.x.x.x in my example. As I don't see reference to an IP address in your example, how can your command be provding that?

Marvin Rhoads Thu, 02/23/2012 - 13:21
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,
  • Cisco Designated VIP,

    2017 Firewalling, Network Management, VPN

The examples I have seen usually specify using an address (or address range) for the dynamic NAT with the interface as a PAT fallback. See for example here.

Actions

This Discussion