topic Firesight NAT Table lookup in Network Security

Firesight NAT Table lookup

bwilson — Tue, 12 Mar 2019 13:11:58 GMT

In Firesight, I'm trying to look up the internal address to NAT address for a specific port, at a specific time. I have the NAT address and the port, and need the internal IP address.

What sensor are you using?

Oliver Kaiser — Tue, 15 Nov 2016 19:27:58 GMT

What sensor are you using? ASA with Firepower module, FTD or Firepower NG-IPS Appliance?

In case you are using ASA Firepower module / FTD, connect to cli and execute the following command:

> show xlate

I'm not sure the difference

bwilson — Thu, 17 Nov 2016 22:58:49 GMT

I'm not sure the difference between FTD and Firepower NG-IPS appliance.

We're not running any ASA services. The chassis is a Firepower 9300. Everything I've seen so far is in the web interface, no command line.

NG-IPS are the dedicated IPS

Oliver Kaiser — Thu, 17 Nov 2016 23:04:10 GMT

NG-IPS are the dedicated IPS appliances from the sourcefire aquisition like Firepower 7000&8000.

If you want to check your nat table on FTD you have to get on the command line of your security module. In case you are using 6.1 you can directly type show xlate to view your current translations. If you are still running 6.0 you have to switch to diagnostic cli using system support diagnostic-cli, enter enable and then the show xlate command.