ASA Pre-8.3 to 8.3 NAT configuration examples

Document

May 12, 2010 9:06 AM
May 12th, 2010

Static NAT/PAT

Pre-8.3 NAT8.3 NAT
Regular Static NAT

static (inside,outside) 192.168.100.100 10.1.1.6 netmask  255.255.255.255

 object network obj-10.1.1.6
   host 10.1.1.6
   nat (inside,outside) static 192.168.100.100    
Regular Static PAT

static (inside,outside) tcp 192.168.100.100 80 10.1.1.16 8080 netmask  255.255.255.255

 object network obj-10.1.1.16
   host 10.1.1.16
   nat (inside,outside) static 192.168.100.100 service tcp 8080 www
Static Policy NAT

access-list NET1 permit ip host 10.1.2.27 10.76.5.0 255.255.255.224

static (inside,outside) 192.168.100.100 access-list NET1

object network obj-10.1.2.27

   host 10.1.2.27
 object network obj-192.168.100.100
   host 192.168.100.100
 object network obj-10.76.5.0
   subnet 10.76.5.0 255.255.255.224
 nat (inside,outside) source static obj-10.1.2.27 obj-192.168.100.100 
                      destination static obj-10.76.5.0 obj-10.76.5.0

 

 

Pre-8.3 NAT8.3 NAT
Regular Dynamic PAT
 nat (inside) 1 192.168.1.0 255.255.255.0
 nat (dmz) 1 10.1.1.0 255.255.255.0
 global (outside) 1 
192.168.100.100
object network obj-192.168.1.0
   subnet 192.168.1.0 255.255.255.0
   nat (inside,outside) dynamic 192.168.100.100
 object network obj-10.1.1.0
   subnet 10.1.1.0 255.255.255.0
   nat (dmz,outside) dynamic 192.168.100.100
Regular Dynamic PAT

 
nat (inside) 1 10.1.2.0 255.255.255.0
global (outside) 1 192.168.100.100
global (dmz) 1 192.168.1.1



 
 object network obj-10.1.2.0
   subnet 10.1.2.0 255.255.255.0
   nat (inside,outside) dynamic 192.168.100.100
 object network obj-10.1.2.0-01
   subnet 10.1.2.0 255.255.255.0
   nat (inside,dmz) dynamic 192.168.1.1

Regular Dynamic PAT-3

 

 nat (inside) 1 0 0 
 global (outside) 1 interface
 object network obj_any
   subnet 0.0.0.0 0.0.0.0
   nat (inside,outside) dynamic interface

Dynamic Policy NAT

 

 object-group network og-net-src
   network-object 192.168.1.0 255.255.255.0
   network-object 192.168.2.0 255.255.255.0
 object-group network og-net-dst
   network-object 192.168.200.0 255.255.255.0
 object-group service og-ser-src
   service-object tcp gt 2000
   service-object tcp eq 1500
 access-list NET6 extended permit object-group og-ser-src 
                  object-group og-net-src object-group og-net-dst
 nat (inside) 10 access-list NET6
 global (outside) 10 192.168.100.100
 object network obj-192.168.100.100
   host 192.168.100.100
 object service obj-tcp-range-2001-65535
   service tcp destination range 2001 65535
 object service obj-tcp-eq-1500
   service tcp destination eq 1500
 nat (inside,outside) source dynamic og-net-src 
             obj-192.168.100.100 destination 
             static og-net-dst og-net-dst
             service obj-tcp-range-2001-65535
             obj-tcp-range-2001-65535
 nat (inside,outside) source dynamic og-net-src 
             obj-192.168.100.100 destination 
             static og-net-dst og-net-dst 
             service obj-tcp-eq-1500 obj-tcp-eq-1500

Policy Dynamic NAT (with multiple ACEs)

 

 access-list ACL_NAT permit ip 172.29.0.0 255.255.0.0 
                               192.168.1.0 255.255.255.0
 access-list ACL_NAT permit ip 172.29.0.0 255.255.0.0 
                               192.168.2.0 255.255.255.0
 access-list ACL_NAT permit ip 172.29.0.0 255.255.0.0 
                               192.168.3.0 255.255.255.0
 access-list ACL_NAT permit ip 172.29.0.0 255.255.0.0 
                               192.168.4.0 255.255.255.0
 nat (inside) 1 access-list ACL_NAT
 global (outside) 1 192.168.100.100
 object network obj-172.29.0.0
   subnet 172.29.0.0 255.255.0.0
 object network obj-192.168.100.100
   host 192.168.100.100
 object network obj-192.168.1.0
   subnet 192.168.1.0 255.255.255.0
object network obj-192.168.2.0
   subnet 192.168.2.0 255.255.255.0
 
object network obj-192.168.3.0
   subnet 192.168.3.0 255.255.255.0
 object network obj-192.168.4.0
   subnet 192.168.4.0 255.255.255.0
nat (inside,outside) source dynamic obj-172.29.0.0 obj-192.168.100.100
             destination static obj-192.168.1.0 obj-192.168.1.0
nat (inside,outside) source dynamic obj-172.29.0.0 obj-192.168.100.100
             destination static obj-192.168.2.0 obj-192.168.2.0
nat (inside,outside) source dynamic obj-172.29.0.0 obj-192.168.100.100
             destination static obj-192.168.3.0 obj-192.168.3.0
nat (inside,outside) source dynamic obj-172.29.0.0 obj-192.168.100.100
             destination static obj-192.168.4.0 obj-192.168.4.0

Outside NAT

 global (inside) 1 10.1.2.30-1-10.1.2.40
 nat (dmz) 1 10.1.1.0 255.255.255.0 outside
 static (inside,dmz) 10.1.1.5 10.1.2.27 netmask 255.255.255.255 
 object network obj-10.1.2.27
   host 10.1.2.27
   nat (inside,dmz) static 10.1.1.5
 object network obj-10.1.1.0
   subnet 10.1.1.0 255.255.255.0
   nat (dmz,inside) dynamic obj-10.1.2.30-10.1.2.40
 object network obj-10.1.2.30-10.1.2.40
   range 10.1.2.30 10.1.2.40

NAT & Interface PAT together

 nat (inside) 1 10.1.2.0 255.255.255.0
 global (outside) 1 interface 
 global (outside) 1 192.168.100.100-192.168.100.200
 object network obj-192.168.100.100_192.168.100.200
   range 192.168.100.100 192.168.100.200
 object network obj-10.1.2.0
   subnet 10.1.2.0 255.255.255.0
   nat (inside,outside) dynamic 
            obj-192.168.100.100_192.168.100.200 interface

NAT & Interface PAT with additional PAT together

 nat (inside) 1 10.0.0.0 255.0.0.0

  global (outside) 1 192.168.100.1-192.168.100.200

  global (outside) 1 interface

  global (outside) 1 192.168.100.210

 object network obj-192.168.100.100_192.168.100.200
   range 192.168.100.100 192.168.100.200
 object network obj-10.0.0.0
   subnet 10.0.0.0 255.0.0.0
 object network second-pat
   host 192.168.100.210
 object-group network dynamic-nat-pat
   network-object object obj-192.168.100.100_192.168.100.200
   network-object object second-pat

nat (inside,outside) dynamic dynamic-nat-pat interface

Twice NAT with both source IP, Dest IP and Source port, Dest port change.

On the inside:

 

Source IP: 10.30.97.129

Dest IP: 10.30.97.200

Source port: 5300

Dest port: any port

 


On the outside:

 

Source IP: Interface IP

Dest IP: 172.16.1.10

Source port: 5300

Dest port: 1022

object network source-real
  host 10.30.97.129
  
object network dest-mapped
  host 10.30.97.200

object network dest-real
  host 172.16.1.10

object service inside-src-dest-port
 service tcp source eq 5300 destination range 0 65535

object service outside-src-dest-port
 service tcp source eq 5300 destination eq 1022


nat (inside,outside) after source static source-real interface destination static dest-mapped dest-real service inside-src-dest-port outside-src-dest-port
 

Static NAT for a Range of Ports

 

Not Possible - Need to write multiple Statements or perform a Static one-to-one NAT.


 

           (in)    (out)

10.1.1.1-------ASA-----

        --xlate-------> 10.2.2.2

Original Ports: 10000 - 10010

Translated ports: 20000 - 20010


object service ports

service tcp source range 10000 10010


object service ports-xlate

service tcp source range 20000 20010


object network server

host 10.1.1.1

 

object network server-xlate

host 10.2.2.2

nat (inside,outside) source static server server-xlate service ports ports-xlate
Average Rating: 5 (10 ratings)

Comments

whanson Thu, 07/29/2010 - 19:20

good stuff. confusing at best but does someone have an example nat (inside) 0   nonat?

thx

gobito156 Mon, 07/11/2011 - 14:54

Pretty please can you help before I totally loose it.

i have followed all the tutorial including the Video by Jay, I ended up with a one of my DMZ Servers working as expected and the second one has no access in or out. both dmzs are accessible from inside whoever the one that dont work can take as long as a 20 seconds for ssh connection prompt  Any ideas?

object network inside-net

subnet 192.168.1.0 255.255.255.0

object network dmz-fbsd-bart

host 192.168.2.2

object network dmz-fbsd-ithcy

host 192.168.2.4

access-list outside_in extended permit ip any host 192.168.2.4

access-list outside_in extended permit ip any host 192.168.2.2

pager lines 24

logging enable

logging asdm debugging

mtu inside 1500

mtu outside 1500

mtu dmz 1500

ip local pool vpn_pool 192.168.1.20-192.168.1.254 mask 255.255.255.0

no failover

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

!

object network inside-net

nat (inside,outside) dynamic interface

object network dmz-fbsd-bart

nat (dmz,any) static XXX.XXX.XXX.71

object network dmz-fbsd-ithcy

nat (dmz,any) static XXX.XXX.XXX.73

access-group outside_in in interface outside

route outside 0.0.0.0 0.0.0.0 XXX.XXX.XXX.1 1


Thanks in advance,

Eren

tahequivoice Fri, 12/09/2011 - 11:02

How would I convert an ACL based natting that takes the incoming packet and translates it to the inside IP of the ASA so the inside server will respond when it uses a different default route?

access-list Outside-Web-Nat permit icmp any host x.x.x.x

access-list Outside-Web-Nat permit tcp any host x.x.x.x eq 443

global (inside) 2 interface

nat (outside) 2 access-list Outside-Web-Nat outside

static (inside,outside) x.x.x.x 10.192.63.9 netmask 255.255.255.255

pshanubh Sat, 12/10/2011 - 06:02 (reply to tahequivoice)

Hi There,

You will get a quicker response if you post it in Dicussions section fyi (

https://supportforums.cisco.com/community/netpro/security/firewall?view=discussions)

As far as your query is concerned:

Access-list based NAT in pre-8.3 is now Double-nat in 8.3 and later. (Policy based NAT)

I would do the following:

object net any

  subnet 0.0.0.0 0.0.0.0

object net Web-Server-Trans

  host x.x.x.x

object net Web-Server-Orig

  host 10.192.63.9

nat (outside,inside) source dynamic any interface dest static Web-Server-Trans Web-Server-Orig

As far as allowing when to nat (tcp 443, icmp), put that in outside interface access-list

Let me know if this works fine for you.

Regards,

Praveen

jyotirmoy11 Fri, 03/23/2012 - 03:33

Hi All,

I have a issue with NAT in ASA 5580 firewal.

1. I have one web server on DMZ zone in ASA firewall with private ip  address. Web application is running on webserver, and I can access this  web application with private ip address from web server itself, But I am  not able to access web application with public NATed ip address(NATED  in ASA firewall) from web server itself.

2. From the outside of the firewall the web server application is accessible with public ip address.

I have configured static NAT in ASA firewall as below-

static (INSIDE,OUTSIDE) 169.1.123.28 10.179.124.24 netmask 255.255.255.255

access-list test2 extended permit ip host 10.179.126.138 any

static (INSIDE,OUTSIDE) 10.179.126.138  access-list test2

Can any body help me in this issue

Reg

Jyotirmoy

jbigrow Mon, 04/09/2012 - 13:01

Hi Folks

I have a new asa5550 with 8.3 on it

I don't want to NAT at all. I want the inside IP's going out. They are globlly routable addresses

do I need to do anything to support this in routed mode on the asa?

thanks

jbigrow Mon, 04/09/2012 - 13:16

so it will just work as is with the ACL's for the global addreses on both sides of the firewall. I.E internet  to inside

inside to internet. since everything is a routable address? we used to use the static (inside, outside) in the older pixes

which just mapped the routable inside to the outside

thats great

thanks

ameyertsg2 Sun, 07/08/2012 - 18:21

I'm a little confused still by the 8.4 configuration of things.  Here is how I have my network setup:

Inside = 10.150.1.0 / 255.255.255.0

External = dynamic

I have an email server that I want to open up port 25 from the outside to the inside. 

Here is what I have in my code so far:

object network Email

subnet 10.150.1.0 255.255.255.0

object network Mail_Server_WWW

host 10.150.1.60

object service SMTP

service tcp source eq smtp

object network smtp

host 10.150.1.60

access-list incoming extended permit tcp any object Mail_Server_WWW eq www

nat (inside,any) source static Subnet_ASM_Local Subnet_ASM_Local destination static VPN_Remote_Subnets VPN_Remote_Subnets

!

object network obj_any-01

nat (inside,outside) dynamic interface

object network Email

nat (inside,outside) static interface service tcp smtp smtp

object network Mail_Server_WWW

nat (inside,outside) static interface service tcp www www

object network smtp

nat (outside,inside) static Email service tcp smtp smtp

What am I missing??

WEERAKOO69BA Wed, 05/01/2013 - 04:37

Hi It's nice,

That means this is the way we have to configure NAT for 8.3 and above???//Pre-8.3 commands will not accept for the same???Hope I am correct??

Thanks

darshan288shah Mon, 06/24/2013 - 02:07

Hi,

I am using ASA5505 with version a 8.3(2) and having problem with the nat configuration.

inside ip - 192.168.1.1/255.255.255.0

outside ip - 10.127.225.10/255.255.255.0

we have TCP10042 as service port thru' which we are passing data from inside network to outside network.

We have Client_server as 10.127.226.21/24

our DataServer as 192.168.1.3/ 24

we want to send the data from dataServer to Client server thru' port no. 10042.

We did following settings in the ASA thru' ASDM but facing problem that no any nating actually takes place.

Object network Client_Server

host 10.127.226.21

Object network DataServer

host 192.168.1.3

Object service TCP_10042

Service tcp source range 1 65535 destination eq 10042

Object network Firewall_Outside

host 10.127.225.10

object network DataServer(192.168.1.3)

nat (inside, outside) static interface service tcp 10042 10042

object network Firewall_outside (10.l27.225.10)

nat (outside, inside) static DataServer(192.168.1.3) service tcp 10042 10042

access-list inside_access_in extended permit ip any any

access-list inside_access_in extended permit tcp any any

access-list outside_access_in extended permit tcp any any

access-list outside_access_in extended permit ip any any

access-group inside_access_in in interface inside

access-group inside_access_out out interface inside

access-group outside_access_in in interface outside

access-group global_access global



but still we are getting problem for NAT rules.

Also when we tried with Packet Transfer check point and found that "Access List - denied due to “Implicit rule”

Please help how we have to transfer data thru' Firewall.

petr.hofmann Tue, 06/25/2013 - 06:35

Hello guys,

I am trying to use your NAT conversion table, but I cant solve it... Can anyone please help me? My old config is following:

access-list outside_1_cryptomap extended permit ip 192.168.1.0 255.255.255.0 any
access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 host 192.168.0.0

access-list 101 extended permit icmp any any echo
access-list 101 extended permit icmp any any echo-reply

access-list inside_nat0_outbound_1 extended permit ip 192.168.1.0 255.255.255.0 192.168.0.0 255.255.255.0
access-list outside_1_cryptomap_1 extended permit ip 192.168.1.0 255.255.255.0 192.168.0.0 255.255.255.0

global (outside) 101 interface
nat (inside) 0 access-list inside_nat0_outbound_1
nat (inside) 101 0.0.0.0 0.0.0.0

access-group 101 in interface outside

David White Wed, 06/26/2013 - 14:00 (reply to petr.hofmann)

Hi Petr,

You only have two NAT rules:

1) nat (inside) 0 access-list inside_nat0_outbound_1

  Which says:  Do not NAT traffic matching access-list inside_nat0_outbound_1 - which is:

      access-list inside_nat0_outbound_1 extended permit ip 192.168.1.0 255.255.255.0 192.168.0.0 255.255.255.0

This translates into the following NAT rule:

object network ServerReal

subnet 192.168.1.0 255.255.255.0

object network RemoteSite

subnet 192.168.0.0 255.255.255.0

nat (inside,outside) source static ServerReal ServerReal destination static RemoteSite RemoteSite

2) global (outside) 101 interface
     nat (inside) 101 0.0.0.0 0.0.0.0

Which says, "PAT all inside traffic to the outside interface IP address"

This will be changed to the following:

  object network any

   subnet 0.0.0.0 0.0.0.0

   nat (inside,outside) dynamic interface

Hope this helps!

David.

odysiuos117 Sat, 07/06/2013 - 14:23

Could someone describe a static nat in PLAIN ENGLISH for me ?

for instance, allowong external access to internal web server (10.1.1.6)

object network obj-WEB-SVR
   host 10.1.1.6
   nat(inside,outside) static 192.168.100.100 

what does the statement say ?

THX

pshanubh Sat, 07/06/2013 - 23:21 (reply to odysiuos117)

The statement says that there is a Web-Server at 10.1.1.6 on the "inside" and it is statically being translated to 192.168.100.100 on the "outside"

odysiuos117 Sun, 07/07/2013 - 00:13 (reply to pshanubh)

In this case the outside user is supposed to initiate the request to the inside web-server, not vice versa.

Still that work ?

pshanubh Sun, 07/07/2013 - 00:19 (reply to odysiuos117)

This is a bi-directional nat statement. So yes, outside user can initiate a connection request to 192.168.100.100 which will then get untranslated to 10.1.1.6 on the inside interface.

PS: We need to allow access to real ip address in the access-list on the outside interface i.e. "permit <protocol> any host 10.1.1.6")

sandman42 Mon, 08/26/2013 - 05:54

One question:

I have a 8.2 nat that says:

nat (inside) 1 0.0.0.0 0.0.0.0

global (outside) 1 interface

This should translate in a 8.4.1:

object network OBJ_GENERIC_ALL

subnet 0.0.0.0 0.0.0.0

nat (inside,outside) dynamic OBJ_GENERIC_ALL

but this give me an error with the caret pointing to the "d" of "dynamic".

What's wrong??????

pshanubh Mon, 08/26/2013 - 06:01 (reply to sandman42)

I see a problem with the statement:

nat (inside,outside) dynamic OBJ_GENERIC_ALL

an ip-address/network-based object should follow the 'dynamic' keyword.

In your case, i see the statement should have been:

object network OBJ_GENERIC_ALL

  nat (inside,outside) dynamic interface

sandman42 Mon, 08/26/2013 - 06:14 (reply to pshanubh)

I've added a

nat (inside,outside) after-auto source dynamic any interface

and now it works.

Thanks anyway

vijay1926 Thu, 12/26/2013 - 10:51

I've been having thoughts about this for a while. We know that PAT uses  TCP/UDP port numbers to distinguish between inside hosts via a mapping  table for private IPs, internal/external ports and all that stuff, all  happen so that the return packets from outside (despite having the same  destination IP) will remap and reach the correct inside host.

Now how can ping/icmp replies route back to the inside while we know  ICMP is not at the TCP/UDP level, so it does NOT use port numbers at  all? Any idea? May be I'm missing some thing.

Practically, I'm behind PAT and I can always ping outside.

David White Thu, 01/02/2014 - 08:02 (reply to vijay1926)

Hi Vijay,

The ICMP ID can be used to associate inside Requests with Responses across PAT translations.

Sincerely,

David.

moyeed.faraaz1 Tue, 01/28/2014 - 10:04

The Ip address  access  from the outside on the dmz  has to be a public address., isnt it ?

Actions

Login or Register to take actions

This Document

Posted May 12, 2010 at 9:06 AM
Stats:
Comments:33 Avg. Rating:5
Views:213115 Contributors:21
Shares:20

Related Content

Documents Leaderboard