topic nat (inside) 0 access-list nonat deprecated in Network Security

nat (inside) 0 access-list nonat deprecated

John Jenard Valencia — Tue, 12 Mar 2019 06:19:39 GMT

Hi, I'm new to firewalling

I'm trying to upgrade from ASA Ver 7.1(2) to ASA Version 9.2(2)4

Im having trouble with global NAT

I have the following config

access-list nonat extended permit ip any any

nat (inside) 0 access-list nonat

However new version of ASA replied that the syntax is deprecated.

Thanks

Hi,For example, if you have

Dinesh Moudgil — Fri, 24 Jul 2015 09:35:11 GMT

Hi,

For example, if you have this natting :-
nat (inside) 0 access-list nat_exemption
access-list nat_exemption extended permit ip 192.168.1.0 255.255.255.0 10.0.0.0 255.255.255.0

This translates to the following syntax:-
object network obj-192.168.1.0
subnet 192.168.1.0 255.255.255.0
object network obj-10.0.0.0
subnet 10.0.0.0 255.255.255.0

Therefore , in your case of nat exemption, you may use

nat (inside,any) source static any any

NOTE :- You might want to change "any" to a specific interface as well.(Not mandatory)

Here is a document for your reference:-
http://www.packetu.com/2012/01/31/migrating-asa-nat-exemption-configuration/

Regards,
Dinesh Moudgil

P.S. Please rate helpful posts.

Please read the following

Karsten Iwen — Fri, 24 Jul 2015 11:41:14 GMT

Please read the following document:

https://supportforums.cisco.com/document/132066/asa-nat-83-nat-operation-and-configuration-format-cli

It's more or less the reference for switching from pre 8.3-NAT to 8.3 and above-NAT.

Thank you for the information

John Jenard Valencia — Sat, 25 Jul 2015 07:34:20 GMT

Thank you for the information

I tried to input nat (inside,any) source static any any

however i cannot reach the clients connected on outside interface.

But fortunately i found the solution on my problem.

i used the below commands and the problem was fixed

object network obj_any

nat (inside,inside) dynamic interface

Thank you

That's not nat-exemption, you

Karsten Iwen — Sat, 25 Jul 2015 07:48:26 GMT

That's not nat-exemption, you are PATing your traffic to the interface IP.