topic Re: Need help ASA configuration ( nat inside and outside) in Network Security

Need help ASA configuration ( nat inside and outside)

itcisco2015 — Sat, 10 Oct 2020 13:00:26 GMT

Dear Sir or Madam,

Itried to do some lab at home and, I got below an error message ASA nat inside and outside configuration. Could you please see the attached and help me.

ASA-FW(config-network)# subnet 10.10.1.0 255.255.255.0
^
ERROR: % Invalid input detected at '^' marker.
ASA-FW(config-network)# nat (inside, outside) dynamic interface
^

Thank you so much for your time and help.

Re: Need help ASA configuration ( nat inside and outside)

Sheraz.Salim — Sat, 10 Oct 2020 18:07:41 GMT

HI you running an old code 8.2 on 5505 but the software 8.2 and 5505 are EOL. the NAT command you trying to put in it will not work. as post 8.4 the unified NAT was introduced. what you trying to configue is a unified nat this was introuduced in post 8.4 on wards. please consider upgrading the software to 9.1.7

you need to upgrade your unit to least 8.4 also to noted i think for 5505 you can only upgrade the software to 9.1.7

here is the link

https://software.cisco.com/download/home/280582808/type/280775065/release/9.1.7%20Interim

Re: Need help ASA configuration ( nat inside and outside)

Aref Alsouqi — Sun, 11 Oct 2020 17:54:59 GMT

If you want to configure PAT on the ASA running pre 8.3 code, you should use the following syntax:

nat (inside) 1 10.10.1.0 255.255.255.0

global (outside) 1 interface

Re: Need help ASA configuration ( nat inside and outside)

Marius Gunnerud — Mon, 12 Oct 2020 09:38:53 GMT

Aref is correct here. For dynamic NAT he has provided the correct solution. If, however, you want to configure a static NAT the you would need to use the following format when using the 8.2 version.

static (inside,outside) tcp 1.1.1.1 10000 10.10.1.2 80 netmask 255.255.255.255

Re: Need help ASA configuration ( nat inside and outside)

itcisco2015 — Wed, 14 Oct 2020 20:49:49 GMT

Thank you for helping me to get this.

Re: Need help ASA configuration ( nat inside and outside)

itcisco2015 — Wed, 14 Oct 2020 21:23:49 GMT

Thank you for helping to this issues. I did the command but there was no internet access. When I connect the inside it had DHCP ip address but there was no still internet connection.

Thank you,
Zam mang

Re: Need help ASA configuration ( nat inside and outside)

itcisco2015 — Wed, 14 Oct 2020 21:24:49 GMT

Hi Sheraz,

Thank you for your help. I won't be able to update IOS.

Thank you,
Zam Mang

Re: Need help ASA configuration ( nat inside and outside)

Marius Gunnerud — Thu, 15 Oct 2020 12:36:31 GMT

How are you testing internet connectivity? If you are just testing with ping then you need to the following commands (this is for through the box traffic):

policy-map global_policy

class inspection_default

inspect icmp

You said you are unable to ping the inside interface of the ASA from MainRouter, this is to be expected. You will not be able to ping an interface on the ASA that is not the ingress interface. You will need to test by pinging a device that connects to the inside interface, for example a switch.

You also mention that you are unable to ping 192.168.1.1, though I do not see this IP configured on your router (which has 192.168.200 configured), is this an IP of a different device?

Keep in mind also that MainRouter has no knowledge of the 10.10.1.0/24 network which is the subnet connected to your ASA inside interface, you need to add routing on the MainRouter if it is to be able to reach this network.