topic Re: NAT cleanup (ASA) in Network Security

NAT cleanup (ASA)

MusaadSaad — Fri, 21 Feb 2020 17:07:08 GMT

Hello Everyone,

I am currently in process to clean up the unused NAT rules.

How I can be sure the rules is not used??

Thx

Re: NAT cleanup (ASA)

Rob Ingram — Thu, 09 May 2019 11:42:56 GMT

Hi,
If you use the command "show nat" this will indicate the translated/un-translated hits. If there are no matches, then possibly the nat rule is not in use or no hits since the ASA was last rebooted.

HTH

Re: NAT cleanup (ASA)

MusaadSaad — Thu, 09 May 2019 11:49:25 GMT

Thank you for your reply.

But do I need to check the output of these two command "show xlate", "show access-list" to make sure this is not used ? or "show nat" and check the translated/un-translated hits is enough?

Re: NAT cleanup (ASA)

Rob Ingram — Thu, 09 May 2019 11:53:33 GMT

You should probably be ok relying on checking the translated/un-translated hits.

Checking the xlate would indicate what nat rule was used, not what nat rule wasn't used.

Re: NAT cleanup (ASA)

MusaadSaad — Thu, 09 May 2019 12:03:43 GMT

Thanks man.