Cleanup and convert from version 8.0(3) to 9.2x

[burleyman]

I have the following config on an ASA ver 8.0.3 and please correct me if I am wrong but the line towards the bottom....

access-list 100 extended permit ip any 10.239.126.0 255.255.255.0

Basically covers everything so all the other lines could be omitted....correct?

nat (inside) 0 access-list 100

access-list 100 extended permit ip host 10.239.14.240 10.239.126.0 255.255.255.0
access-list 100 extended permit ip host 10.239.10.170 10.239.126.0 255.255.255.0
access-list 100 extended permit ip host 10.239.17.170 10.239.126.0 255.255.255.0
access-list 100 extended permit ip host 10.239.13.170 10.239.126.0 255.255.255.0
access-list 100 extended permit ip host 10.239.1.79 10.239.126.0 255.255.255.0
access-list 100 extended permit ip host 10.239.23.99 10.239.126.0 255.255.255.0
access-list 100 extended permit ip host 10.239.19.35 10.239.126.0 255.255.255.0
access-list 100 extended permit ip host 10.239.19.12 10.239.126.0 255.255.255.0
access-list 100 extended permit ip host 10.239.19.11 10.239.126.0 255.255.255.0
access-list 100 extended permit ip 10.239.1.0 255.255.255.0 10.239.126.0 255.255.255.0
access-list 100 extended permit ip host 10.239.23.11 10.239.126.0 255.255.255.0
access-list 100 extended permit ip 10.239.19.0 255.255.255.0 10.239.126.0 255.255.255.0
access-list 100 extended permit ip 10.239.0.0 255.255.0.0 10.239.126.0 255.255.255.0
access-list 100 extended permit ip host 10.239.23.240 10.239.126.0 255.255.255.0
access-list 100 extended permit ip host 10.239.23.242 10.239.126.0 255.255.255.0
access-list 100 extended permit ip host 10.239.23.241 10.239.126.0 255.255.255.0
access-list 100 extended permit ip any 10.239.126.0 255.255.255.0
access-list 100 extended permit ip 10.239.23.0 255.255.255.0 10.239.126.0 255.255.255.0
access-list 100 extended permit ip host 10.239.1.12 10.239.126.0 255.255.255.0
access-list 100 extended permit ip 10.239.17.0 255.255.255.0 10.239.126.0 255.255.255.0
access-list 100 extended permit ip host 10.239.1.9 10.239.126.0 255.255.255.0

Thanks

Mike

[Marvin Rhoads]

That's correct. Looks like somebody got tired of adding the more specific entries and just stuck in the "any" rule and neglected to remove the ones that it supercedes.

The only reason I can think of for keeping the more specific ones would be if you're trying to track the number of hits on the access-list entries for them. Otherwise the single line you mentioned can be migrated.

Of course the syntax is a bit different in 8.3+.

[burleyman]

Thank you. Now based on that I want to convert the following

Convert.....

nat (inside) 0 access-list 100

access-list 100 extended permit ip any 10.239.126.0 255.255.255.0
access-list 100 extended permit ip 10.239.1.0 255.255.255.0 192.168.10.0 255.255.255.0
access-list 100 extended permit ip 10.239.1.0 255.255.255.0 172.16.40.0 255.255.255.0

to this.......

object network NAT-10.239.126.0-24
 subnet 10.239.126.0 255.255.255.0

object network NAT-10.239.1.0-24
 subnet 10.239.1.0 255.255.255.0

object network NAT-192.168.10.0-24
 subnet 192.168.10.0 255.255.255.0

object network NAT-172.16.40.0-24
 subnet 172.16.40.0 255.255.255.0

nat (inside,outside) source dynamic any any destination static NAT-10.239.126.0-24 NAT-10.239.126.0-24
nat (inside,outside) source dynamic NAT-10.239.1.0-24 NAT-10.239.1.0-24 destination static NAT-192.168.10.0-24 NAT-192.168.10.0-24
nat (inside,outside) source dynamic NAT-10.239.1.0-24 NAT-10.239.1.0-24 destination static NAT-172.16.40.0-24 NAT-172.16.40.0-24

Would this be correct?

Mike

[Murali]

Hello MIke,

In 8.0 you've configuration for no-nat this is because in 8.0 we can't disable nat control (nat is mandatory if you are going from inside to any interface) so we have use the mentioned config. But in the latest versions we don't have the concept of nat control.

[burleyman]

Thanks.

So let me ask this. Based on the above original config and moving to 9.x do I need to carry over the config or should I leave it off and it will work as is?

Mike

[Murali]

Yes only for the nat 0 configuration , you need not configure anything extra in latest code.

Thanks!

[burleyman]

Thanks for all your help.