12-25-2011 10:15 AM - edited 03-11-2019 03:06 PM
Hello Dears
I m grouping {object network} to one object group for the Dynamic PAT, But there is no option of dynamic after Nat (inside,outside)
ciscoasa(config)# sh run object-group
object-group network outside-interface
network-object object obj-20.20.20.0
network-object object obj-30-30-30-30
ciscoasa(config)# object-group network outside-interface
ciscoasa(config-network-object-group)# nat (inside,outside) ?
configure mode commands/options:
<1-2147483647> Position of NAT rule within before auto section
after-auto Insert NAT rule after auto section
source Source NAT parameters
Tx
Solved! Go to Solution.
12-26-2011 10:07 AM
Hello Estela,
Good to hear from you.
Today while I was doing some labs recreations, I could confirm that now object-groups are supported for the nat statements as well as the ACLs.
Now I will response to your first question on this post.
Question1 :I m grouping {object network} to one object group for the Dynamic PAT, But there is no option of dynamic after Nat (inside,outside)
Answer 1: The correct syntax would be
-nat (inside,outside) source dynamic outside-interface interface
Question 2:
according to ur example what this command will do :
Nat (inside,outside) source dynamic 1.1.1.1-host 2.2.2.2-host
Answer 2:
This nat statement will nat with pat (dynamic) all the object network 1.1.1.1-host to the outside object network 2.2.2.2-host.
Hope this helps! any other question let me know,
Regards,
Do please rate helpful posts.
Julio
12-25-2011 10:26 AM
Hello Estela,
Object-groups will be used for the ACLs, on the nat you cannot use them, you can use object networks (host,subnet, or range of ip addresses) and object services(Protocol, port)
The syntax will be like this:
object network 1.1.1.1-host
host 1.1.1.1
object network 2.2.2.2-host
host 2.2.2.2
Nat (inside,outside) source dynamic 1.1.1.1-host 2.2.2.2-host
Please do rate helpful posts.
Kind regards,
Julio
12-25-2011 11:42 AM
12-26-2011 10:07 AM
Hello Estela,
Good to hear from you.
Today while I was doing some labs recreations, I could confirm that now object-groups are supported for the nat statements as well as the ACLs.
Now I will response to your first question on this post.
Question1 :I m grouping {object network} to one object group for the Dynamic PAT, But there is no option of dynamic after Nat (inside,outside)
Answer 1: The correct syntax would be
-nat (inside,outside) source dynamic outside-interface interface
Question 2:
according to ur example what this command will do :
Nat (inside,outside) source dynamic 1.1.1.1-host 2.2.2.2-host
Answer 2:
This nat statement will nat with pat (dynamic) all the object network 1.1.1.1-host to the outside object network 2.2.2.2-host.
Hope this helps! any other question let me know,
Regards,
Do please rate helpful posts.
Julio
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide