topic Re: Change NAT policy order in ASA 8.0 in Network Security

topic Re: Change NAT policy order in ASA 8.0 in Network Security https://community.cisco.com/t5/network-security/change-nat-policy-order-in-asa-8-0/m-p/3516804#M132973 <HTML><HEAD></HEAD><BODY><P>This might help:</P><P><A href="https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/116388-technote-nat-00.html#anc9" title="https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/116388-technote-nat-00.html#anc9">ASA Network Address Translation Configuration Troubleshooting - Cisco</A></P><P>says,</P><H3 style="margin: 20px 0 10px; font-family: CiscoSans, Arial, sans-serif; font-size: 16px; font-style: normal; font-weight: bold; color: #58585b; text-align: start; text-indent: 0px;">Problem: Manual NAT Rules are out-of-order, which causes incorrect packet matches</H3><BLOCKQUOTE><TABLE border="1"><TBODY><TR><TD> <P>...</P> <P style="margin: 0 0 6px; font-family: CiscoSans, Arial, sans-serif; font-size: 14px; font-style: normal; font-weight: 400; color: #58585b; text-align: start; text-indent: 0px;"><STRONG style="font-family: inherit; font-size: inherit; font-style: inherit; font-weight: bold;">Solution:<SPAN class="Apple-converted-space"> </SPAN></STRONG></P> <P style="margin: 0 0 6px; font-family: CiscoSans, Arial, sans-serif; font-size: 14px; font-style: normal; font-weight: 400; color: #58585b; text-align: start; text-indent: 0px;">NAT rules can be reordered with the CLI if you remove the rule and reinsert it at a specific line number. In order to insert a new rule at a specific line, enter the line number just after the interfaces are specified.</P> <P style="margin: 0 0 6px; font-family: CiscoSans, Arial, sans-serif; font-size: 14px; font-style: normal; font-weight: 400; color: #58585b; text-align: start; text-indent: 0px;">Example:</P> <PRE style="margin: 10px 0; padding: 0 0 5px; font-family: courier; font-size: 14px; font-style: normal; font-weight: 300; color: #58585b; text-align: start; text-indent: 0px;">ASA(config)# <STRONG style="font-family: inherit; font-size: inherit; font-style: inherit; font-weight: bold;">nat (inside,outside) 1 source static 10.10.10.0-net<BR />10.10.10.0-net destination static 192.168.1.0-net 192.168.1.0-net</STRONG></PRE></TD></TR></TBODY></TABLE></BLOCKQUOTE> </BODY></HTML> Tue, 27 Mar 2018 02:52:02 GMT hslai 2018-03-27T02:52:02Z Change NAT policy order in ASA 8.0 https://community.cisco.com/t5/network-security/change-nat-policy-order-in-asa-8-0/m-p/3516802#M132970 <HTML><HEAD></HEAD><BODY><P>Hello!!!</P><P></P><P>I want to change nat policy order via CLI.</P><P></P><P>I want rule number 3 move to number 2 and rule number 4 move to number 3.</P><P></P><P><STRONG>ASA5510 version 8.0</STRONG></P><P></P><P>ASA(config)# show nat inside srb</P><P>  match ip inside 192.168.1.0 255.255.255.0 srb 192.168.100.0 255.255.255.0</P><P>    NAT exempt</P><P>    translate_hits = 0, untranslate_hits = 0</P><P>  match ip inside 192.168.1.0 255.255.255.0 srb any</P><P>    static translation to 192.168.1.0</P><P>    translate_hits = 1754, untranslate_hits = 19490</P><P>  match ip inside 192.168.1.0 255.255.255.0 srb 192.168.10.0 255.255.255.0</P><P>    dynamic translation to pool 10 (172.16.101.0)</P><P>    translate_hits = 0, untranslate_hits = 0</P><P>  match ip inside 192.168.1.0 255.255.255.0 srb 172.16.201.0 255.255.255.0</P><P>    dynamic translation to pool 10 (172.16.101.0)</P><P>    translate_hits = 0, untranslate_hits = 0</P><P>  match ip inside 172.16.101.0 255.255.255.0 srb any</P><P>    dynamic translation to pool 20 (No matching global)</P><P>    translate_hits = 0, untranslate_hits = 0</P><P>  match ip inside 192.168.1.0 255.255.255.0 srb any</P><P>    dynamic translation to pool 20 (No matching global)</P><P>    translate_hits = 0, untranslate_hits = 0</P><P>  match ip inside any srb any</P><P>    no translation group, implicit deny</P><P>    policy_hits = 0</P></BODY></HTML> Mon, 26 Mar 2018 14:55:42 GMT https://community.cisco.com/t5/network-security/change-nat-policy-order-in-asa-8-0/m-p/3516802#M132970 hseakleang1 2018-03-26T14:55:42Z Re: Change NAT policy order in ASA 8.0 https://community.cisco.com/t5/network-security/change-nat-policy-order-in-asa-8-0/m-p/3516803#M132971 <HTML><HEAD></HEAD><BODY><P>Please ask this question under firewall section of community site. I am unable to move this question to that space.</P><P>THis is policy and Access where you can ask questions about ISE, Trustsec, Anyconnect, ACS etc.</P><P></P><P>-Krishnan</P></BODY></HTML> Mon, 26 Mar 2018 23:01:38 GMT https://community.cisco.com/t5/network-security/change-nat-policy-order-in-asa-8-0/m-p/3516803#M132971 kthiruve 2018-03-26T23:01:38Z Re: Change NAT policy order in ASA 8.0 https://community.cisco.com/t5/network-security/change-nat-policy-order-in-asa-8-0/m-p/3516804#M132973 <HTML><HEAD></HEAD><BODY><P>This might help:</P><P><A href="https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/116388-technote-nat-00.html#anc9" title="https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/116388-technote-nat-00.html#anc9">ASA Network Address Translation Configuration Troubleshooting - Cisco</A></P><P>says,</P><H3 style="margin: 20px 0 10px; font-family: CiscoSans, Arial, sans-serif; font-size: 16px; font-style: normal; font-weight: bold; color: #58585b; text-align: start; text-indent: 0px;">Problem: Manual NAT Rules are out-of-order, which causes incorrect packet matches</H3><BLOCKQUOTE><TABLE border="1"><TBODY><TR><TD> <P>...</P> <P style="margin: 0 0 6px; font-family: CiscoSans, Arial, sans-serif; font-size: 14px; font-style: normal; font-weight: 400; color: #58585b; text-align: start; text-indent: 0px;"><STRONG style="font-family: inherit; font-size: inherit; font-style: inherit; font-weight: bold;">Solution:<SPAN class="Apple-converted-space"> </SPAN></STRONG></P> <P style="margin: 0 0 6px; font-family: CiscoSans, Arial, sans-serif; font-size: 14px; font-style: normal; font-weight: 400; color: #58585b; text-align: start; text-indent: 0px;">NAT rules can be reordered with the CLI if you remove the rule and reinsert it at a specific line number. In order to insert a new rule at a specific line, enter the line number just after the interfaces are specified.</P> <P style="margin: 0 0 6px; font-family: CiscoSans, Arial, sans-serif; font-size: 14px; font-style: normal; font-weight: 400; color: #58585b; text-align: start; text-indent: 0px;">Example:</P> <PRE style="margin: 10px 0; padding: 0 0 5px; font-family: courier; font-size: 14px; font-style: normal; font-weight: 300; color: #58585b; text-align: start; text-indent: 0px;">ASA(config)# <STRONG style="font-family: inherit; font-size: inherit; font-style: inherit; font-weight: bold;">nat (inside,outside) 1 source static 10.10.10.0-net<BR />10.10.10.0-net destination static 192.168.1.0-net 192.168.1.0-net</STRONG></PRE></TD></TR></TBODY></TABLE></BLOCKQUOTE> </BODY></HTML> Tue, 27 Mar 2018 02:52:02 GMT https://community.cisco.com/t5/network-security/change-nat-policy-order-in-asa-8-0/m-p/3516804#M132973 hslai 2018-03-27T02:52:02Z