topic Hi, in Network Security

NATTING for 9.5

adamgibs7 — Tue, 12 Mar 2019 07:33:11 GMT

Dear

I have migrated from 8.2 to 9.2 i have verified the configuration it has been migrated properly but I see lots of below commands not for only inside and DMZ but for others interfaces also, ,

object network obj_any

subnet 0.0.0.0 0.0.0.0 -------this means in subnet ip address if I am not wrong any ip address ???

object network obj-0.0.0.0

host 0.0.0.0 -----what does this means any host with any ip address ????

COMMANDS

object network obj_any
subnet 0.0.0.0 0.0.0.0

object network obj_any
nat (INSIDE,DMZ) dynamic obj-0.0.0.0

object network obj-0.0.0.0
host 0.0.0.0

object network obj_any
nat (INSIDE,DMZ) dynamic obj-0.0.0.0

Hello

Henrik Grankvist — Tue, 29 Mar 2016 18:31:58 GMT

Hello

In pre-8.3 code you had to NAT all the traffic if using nat-control eventhough you didn't have to NAT that traffic, if for example you had public IP adresses in the DMZ.

So that config is dynamic identity NAT, meaning you NAT the traffic to its own IP address, which is the same thing as doing nothing.

You can remove those NAT commands without effecting anything.

Hi,

Marco Soeder-Schuettler — Tue, 29 Mar 2016 20:13:37 GMT

Hi,

have you done the recommended upgrade Path?

This example Path is for ASA5505

From 8.2 first Upgrade to 8.2(5) the last pre8.3 IOS.

In next step auto migrate to 8.4(7), here all NAT statements will be converted, after these step test functions.

Auto migrate now to 9.0(4) and then to 9.2(4) latest. In these upgade step for example encryption statements were converted (like isakmo to ikev1 etc.) and IPv6 features were implemented and some more.

For other Hardware search in ASA IOS Software for the latest IOS and recommended Upgrade steps.

I´ve done some of these upgrades last time without any problems.

Regards

Marco

Thanks Henrick and Marco

adamgibs7 — Thu, 31 Mar 2016 05:23:33 GMT

Thanks Henrick and Marco

when I migrated to 9.5 all my access-list are showing me like below, but in startup config I can see the IP address.any ideas please.

access-list DMZ extended permit tcp host :: host :: eq www

anybody can help me for the

adamgibs7 — Fri, 01 Apr 2016 12:03:22 GMT

anybody can help me for the above query