topic Hi,Converted statement for in Network Security

Object network nonat

richard.schultz1 — Tue, 12 Mar 2019 06:09:30 GMT

Good morning all (or evening, however)

I have a question!

I am looking to create a nonat object that contains an object-group. Is this possible?

ASA version 8.6(1)2

object-group network awesome

network-object host x.x.x.x

network-object host x.x.x.y

nat (inside,outside) source static nonat(172.16.248.0-24) nonat(172.16.248.0-24) destination static nonat(awesome) nonat(awesome)

Well, when I go to create the nonat object there's no option for object-group.

Curious if there's a different way to do this, if this is even necessary, or if I'm pipe dreaming.

Vibhor Amrodia — Fri, 19 Jun 2015 14:06:40 GMT

Hi,

You can create a manual NAT and reference the Object Group in it:-

nat (inside,outside) source static obj-172.16.248.0-24 obj-172.16.248.0-24 destination static awesome awesome no-proxy-arp route-lookup

Refer:-

http://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/nat_objects.html

Thanks and Regards,

Vibhor Amrodia

richard.schultz1 — Mon, 22 Jun 2015 13:54:44 GMT

Excellent!

That being said, how would that look reflected on the distant end running PIX 8.0(4)?

access-list nonat extended permit ip object-group awesome 172.16.248.0 255.255.255.0

If the object-group awesome is in reference to a particular interface, would that look like.

Sorry, I'm a bit noobish. (and by a bit I mean quite)

Vibhor Amrodia — Tue, 23 Jun 2015 11:43:38 GMT

Hi,

Converted statement for Pix 8.x would be:-

access-list nonat extended permit ip 172.16.248.0 255.255.255.0 object-group awesome

nat (inside) 0 access-list nonat

Thanks and Regards,

Vibhor Amrodia

richard.schultz1 — Wed, 24 Jun 2015 12:40:23 GMT

Very good! Thank you so much!