topic nat conversion in Network Security

nat conversion

mickyq — Tue, 12 Mar 2019 06:39:07 GMT

Im busy working through converting an 8.2 config to the new nat procedures.

can someone clarify if my interpretation of this nat is correct please.

8.2

nat (dmz) 0 10.1.1.0 255.255.255.0

8.4 upwards

object network OBJ-10.1.1.0-24

subnet 10.1.1.0 255.255.255.0

nat (dmz,any) after-auto source static OBJ-10.1.1.0-24 OBJ-10.1.1.0-24

Im placing it after any other nats in section 3.

Hi,The new NAT statement that

Pulkit Saxena — Fri, 25 Sep 2015 15:26:17 GMT

Hi,

The new NAT statement that you are applying is a static translation to its own.

Please check this link for difference in statements in 8.2 and 8.3 and above :

https://supportforums.cisco.com/document/33921/asa-pre-83-83-nat-configuration-examples

Regards,

Pulkit Saxena

HiI haven't worked with NAT

Henrik Grankvist — Sat, 26 Sep 2015 19:57:27 GMT

I haven't worked with NAT pre-8.2, so I'm not really comfortable with it.

But I think that in pre-8.2 NAT you did identity NAT because of NAT control, meaning you have to have a NAT statement or the traffic wont pass the ASA. That is not the case anymore. So if you want traffic to go from the DMZ to the inside you don't need a NAT statement for it.

So without knowing how your network looks like, I would say you do not need that NAT rule you are describing.

nat (dmz,any) after-auto

Peter Koltl — Sun, 27 Sep 2015 18:36:45 GMT

nat (dmz,any) after-auto source static OBJ-10.1.1.0-24 OBJ-10.1.1.0-24

It's OK but I prefer section 1 (i. e. without after-auto)

However, noNAT / identity NAT statements should usually be restricted to RFC1918 destination subnets. Your example may not enable DMZ hosts' traffic to the Internet to be NATed.

Thanks for you replies guys.I

mickyq — Mon, 28 Sep 2015 07:37:42 GMT

Thanks for you replies guys.

I believe you are all correct.

What I think ill do is not apply this nat unless I come across any problems. I can then try applying it to section 1.

Thanks again.