topic Thank you. Now based on that in Network Security

Cleanup and convert from version 8.0(3) to 9.2x

burleyman — Tue, 12 Mar 2019 05:05:05 GMT

I have the following config on an ASA ver 8.0.3 and please correct me if I am wrong but the line towards the bottom....

access-list 100 extended permit ip any 10.239.126.0 255.255.255.0

Basically covers everything so all the other lines could be omitted....correct?

nat (inside) 0 access-list 100

access-list 100 extended permit ip host 10.239.14.240 10.239.126.0 255.255.255.0
access-list 100 extended permit ip host 10.239.10.170 10.239.126.0 255.255.255.0
access-list 100 extended permit ip host 10.239.17.170 10.239.126.0 255.255.255.0
access-list 100 extended permit ip host 10.239.13.170 10.239.126.0 255.255.255.0
access-list 100 extended permit ip host 10.239.1.79 10.239.126.0 255.255.255.0
access-list 100 extended permit ip host 10.239.23.99 10.239.126.0 255.255.255.0
access-list 100 extended permit ip host 10.239.19.35 10.239.126.0 255.255.255.0
access-list 100 extended permit ip host 10.239.19.12 10.239.126.0 255.255.255.0
access-list 100 extended permit ip host 10.239.19.11 10.239.126.0 255.255.255.0
access-list 100 extended permit ip 10.239.1.0 255.255.255.0 10.239.126.0 255.255.255.0
access-list 100 extended permit ip host 10.239.23.11 10.239.126.0 255.255.255.0
access-list 100 extended permit ip 10.239.19.0 255.255.255.0 10.239.126.0 255.255.255.0
access-list 100 extended permit ip 10.239.0.0 255.255.0.0 10.239.126.0 255.255.255.0
access-list 100 extended permit ip host 10.239.23.240 10.239.126.0 255.255.255.0
access-list 100 extended permit ip host 10.239.23.242 10.239.126.0 255.255.255.0
access-list 100 extended permit ip host 10.239.23.241 10.239.126.0 255.255.255.0
access-list 100 extended permit ip any 10.239.126.0 255.255.255.0
access-list 100 extended permit ip 10.239.23.0 255.255.255.0 10.239.126.0 255.255.255.0
access-list 100 extended permit ip host 10.239.1.12 10.239.126.0 255.255.255.0
access-list 100 extended permit ip 10.239.17.0 255.255.255.0 10.239.126.0 255.255.255.0
access-list 100 extended permit ip host 10.239.1.9 10.239.126.0 255.255.255.0

Thanks

Mike

That's correct. Looks like

Marvin Rhoads — Fri, 14 Nov 2014 20:41:09 GMT

That's correct. Looks like somebody got tired of adding the more specific entries and just stuck in the "any" rule and neglected to remove the ones that it supercedes.

The only reason I can think of for keeping the more specific ones would be if you're trying to track the number of hits on the access-list entries for them. Otherwise the single line you mentioned can be migrated.

Of course the syntax is a bit different in 8.3+.

Thank you. Now based on that

burleyman — Fri, 14 Nov 2014 21:15:58 GMT

Thank you. Now based on that I want to convert the following

Convert.....

nat (inside) 0 access-list 100

access-list 100 extended permit ip any 10.239.126.0 255.255.255.0
access-list 100 extended permit ip 10.239.1.0 255.255.255.0 192.168.10.0 255.255.255.0
access-list 100 extended permit ip 10.239.1.0 255.255.255.0 172.16.40.0 255.255.255.0

to this.......

object network NAT-10.239.126.0-24
subnet 10.239.126.0 255.255.255.0

object network NAT-10.239.1.0-24
subnet 10.239.1.0 255.255.255.0

object network NAT-192.168.10.0-24
subnet 192.168.10.0 255.255.255.0

object network NAT-172.16.40.0-24
subnet 172.16.40.0 255.255.255.0

nat (inside,outside) source dynamic any any destination static NAT-10.239.126.0-24 NAT-10.239.126.0-24
nat (inside,outside) source dynamic NAT-10.239.1.0-24 NAT-10.239.1.0-24 destination static NAT-192.168.10.0-24 NAT-192.168.10.0-24
nat (inside,outside) source dynamic NAT-10.239.1.0-24 NAT-10.239.1.0-24 destination static NAT-172.16.40.0-24 NAT-172.16.40.0-24

Would this be correct?

Mike

Hello MIke,In 8.0 you've

Murali — Sat, 15 Nov 2014 14:34:51 GMT

Hello MIke,

In 8.0 you've configuration for no-nat this is because in 8.0 we can't disable nat control (nat is mandatory if you are going from inside to any interface) so we have use the mentioned config. But in the latest versions we don't have the concept of nat control.

Thanks.So let me ask this.

burleyman — Mon, 17 Nov 2014 13:39:48 GMT

Thanks.

So let me ask this. Based on the above original config and moving to 9.x do I need to carry over the config or should I leave it off and it will work as is?

Mike

Yes only for the nat 0

Murali — Mon, 17 Nov 2014 14:10:08 GMT

Yes only for the nat 0 configuration , you need not configure anything extra in latest code.

Thanks!

Thanks for all your help.

burleyman — Mon, 17 Nov 2014 14:31:54 GMT

Thanks for all your help.