topic 1. packets captured in Network Security

Object-NAT question

Cisco Freak — Tue, 12 Mar 2019 08:51:02 GMT

Hi Experts,

I was trying to learn object-nat in ASA. I tried this NAT configuration, but it's not working.

I have defined these objects for testing:

object network 1.1.1.0_252
subnet 1.1.1.0 255.255.255.252

object network 12.1.1.96_252
subnet 12.1.1.96 255.255.255.252

I have added this NAT config after defining objects:

ciscoasa(config)# object network 1.1.1.0_252

ciscoasa(config-network-object)# nat (inside,outside) static 12.1.1.96_252

The command got accepted by the ASA, but when I check the ASA configuration, it doesn't show any NAT config.

ciscoasa(config-network-object)# sh run nat
ciscoasa(config-network-object)#

Can you please explain why this is not working with object-nat? I know I can add it in manual section. But I am curious to know why object-nat is not working.

ciscoasa(config)# nat (inside,outside) source static 1.1.1.0_252 12.1.1.96_252
ciscoasa(config)# sh run nat
nat (inside,outside) source static 1.1.1.0_252 12.1.1.96_252

1. packets captured

choiky001 — Sun, 29 Jan 2017 04:41:29 GMT

1. packets captured

-> show cap capin

-> show cap capout

ex :

asa#packet-tracer input outside tcp 209.165.200.225 1234 10.2.3.2 80

-> Check nat packets.

2. show nat detail

-> translate_hits . count chek.

3.http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/116388-technote-nat-00.html

I question is why the

Cisco Freak — Sun, 29 Jan 2017 22:37:17 GMT

I question is why the configuration is not even showing in the running configuration.

Running config output:

ciscoasa(config-network-object)# sh run nat
ciscoasa(config-network-object)#