topic Re: Simple ASA NAT question... in Network Security

Simple ASA NAT question...

MicJameson1 — Tue, 19 Dec 2023 14:26:54 GMT

Hello.

May you please explain to me which ip-addresses the below ASA5525 NAT command translate to which IP-addresses?

"nat (inside,outside) source dynamic OBJECT_1"

Thank you.

Re: Simple ASA NAT question...

Rob Ingram — Tue, 19 Dec 2023 14:37:38 GMT

@MicJameson1 traffic on the inside interface will be translated on the outside interface to the IP address defined in the object called "OBJECT_1".

You can use show run object from the CLI to determine the object configuration,

Re: Simple ASA NAT question...

MHM Cisco World — Tue, 19 Dec 2023 14:37:15 GMT

We use this to translate INside Subnet to one or more Public IP that is reachable via Outside interface.

MHM

Re: Simple ASA NAT question...

MicJameson1 — Tue, 19 Dec 2023 14:45:43 GMT

may you please explain the same for below?

"nat (inside,outside) source dynamic OBJECT_1 interface"

Thank you!

Re: Simple ASA NAT question...

Rob Ingram — Tue, 19 Dec 2023 14:47:52 GMT

@MicJameson1 if the object "OBJECT_1" is exhausted, then translated behind the outside interface.

Re: Simple ASA NAT question...

MHM Cisco World — Tue, 19 Dec 2023 14:50:37 GMT

Each interface can PAT to around 65000 after that the PAT not work' so we add more than IP (must reachable via OUTside) to make PAT NATing 65000XIP we add

MHM

Re: Simple ASA NAT question...

MicJameson1 — Tue, 19 Dec 2023 16:13:51 GMT

"nat (inside,outside) source dynamic OBJECT_1"

---

You say... "traffic on the inside interface will be translated on the outside interface to the IP address defined in the object called "OBJECT_1".

It seems the ASA contradicts your statement...

ASA5525# nat (inside,ouside) source dynamic ?

configure mode commands/options:
WORD Specify object or object-group name for real source.

What are your thoughts?

---

Re: Simple ASA NAT question...

Rob Ingram — Tue, 19 Dec 2023 16:48:37 GMT

@MicJameson1 in your first post you provided the following configuration "nat (inside,outside) source dynamic OBJECT_1", this is incorrect if applied globally, it can only be configured under an object - which was my assumption that you were referring to in my responses. What are you actually trying to achieve?

Re: Simple ASA NAT question...

MHM Cisco World — Tue, 19 Dec 2023 17:17:33 GMT

As @Rob Ingram mentioned

There are two dynamic one manual and other is auto.

What you use is auto which is use objects,

Here you must config object specify one IP or more.

Both are same except the order the asa check.

The asa check manual NAT then auto NAT

MHM