topic Re: View external ips accessing NAT in Network Security

View external ips accessing NAT

mcliff — Thu, 12 May 2022 15:53:46 GMT

Hello,

How can I view what the external IP's are that are accessing a NAT on ASA 5515? In the ASDM I've gone to the Access Rules tab and selected the one I want and I've picked show log but the window it opens doesn't show me anything. Any help would be appreciated, thanks.

Re: View external ips accessing NAT

Flavio Miranda — Thu, 12 May 2022 16:09:12 GMT

You can use command line for that: "show xlate". CLI on this case is easier to see.

You can also use the packetTracert

Re: View external ips accessing NAT

mcliff — Thu, 12 May 2022 16:38:53 GMT

Hi Flavio,

When I issue the show xlate command it looks the same to me as viewing the log in the ASDM, it just shows all of our internal ips going to our public ip. Is there a way to only view external users ip's that are accessing the one internal ip that is being NAT'ed though?

The packet tracer seems to just show you what would happen if an external ip tried to access the NAT'ed IP, if it would be allowed or denied based on the rules?

Please let me know if I am doing this wrong as I am sure I am.

Re: View external ips accessing NAT

balaji.bandi — Thu, 12 May 2022 16:54:52 GMT

May be you can try : (not sure below help please let me know if that suites)

# show xlate | inc XXXXX (the Internal IP here)

#show xlate local x.x.x.x

# sh nat detail | include x.x.x.x

Re: View external ips accessing NAT

MHM Cisco World — Thu, 12 May 2022 17:05:24 GMT

Use keyword detail with packet-tracer give you all nat use by this traffic.

Re: View external ips accessing NAT

Rob Ingram — Thu, 12 May 2022 17:31:24 GMT

@mcliff use the command show local-host <private ip address>

Example below determines there are 2 connections and lists the source public (external) IP addresses connecting to that server.

Re: View external ips accessing NAT

mcliff — Thu, 12 May 2022 18:41:38 GMT

Hello,

The show xlate | inc and the show local-host both work thank you. One more thing I'll ask and maybe there isn't a way to do this, how do I get a days worth of these logs? It looks like it shows the currently connected connections but once those connections are done it goes away and no longer shows. I am assuming I will need to setup some kind of syslog server to track this somehow?

Thanks again for the help.

Re: View external ips accessing NAT

MHM Cisco World — Thu, 12 May 2022 18:45:21 GMT

If you can config log with nat use by this host

This make nat log when new entry add to xlate.

Re: View external ips accessing NAT

balaji.bandi — Thu, 12 May 2022 22:11:53 GMT

yes, that is the best approach if you looking for archive data,