topic Re: Need Assistance with Translating Old NAT 8.2 with new NAT statements in 9.6 in Network Security

Need Assistance with Translating Old NAT 8.2 with new NAT statements in 9.6

Abid7897061 — Thu, 18 Jul 2019 02:02:18 GMT

Hi I need to translate old NAT statements to New statements and wanna verify if my statements are correct and what needs to be done to verify if all good :

Old:

global (outside) 1 interface
nat (outside) 0 access-list MGT-NAT-EXEMPT
nat (inside) 0 access-list WORKER-NAT-EXEMPT
access-group MGT-ACL-IN in interface outside
access-group WORKER-ACL-OUT in interface inside

no nat (inside) 1 0.0.0.0 0.0.0.0
nat (inside) 1 192.168.31.0 255.255.254.0 tcp 0 0 udp 0

provided :

MGT-NAT-EXEMPT & WORKER-NAT-EXEMPT are extended ACLs that permit Host A & Network A for each other

how does each statement translate to new ASA versions

Re: Need Assistance with Translating Old NAT 8.2 with new NAT statements in 9.6

Francesco Molino — Thu, 18 Jul 2019 03:05:52 GMT

Hi

You got few tools which can help you:
- https://fwm.cisco.com/auth.do;jsessionid=36C436A92196CFA9BDBEFFD5F48B16AF#appstore:1

- https://www.tunnelsup.com/nat-converter/

Re: Need Assistance with Translating Old NAT 8.2 with new NAT statements in 9.6

Abid7897061 — Fri, 30 Aug 2019 18:11:44 GMT

Hi ,

that tunnels up link is very help ful thanks for that .

currently VPN tunnel is up , i am able to reach internal networks however i cant reach internet .

i think i am missing something here , as per ASDM logs some TCP connections are denied so i suspect below line has not been translated.

nat (inside) 1 10.129.30.0 255.255.254.0 tcp 0 0 udp 0 , what would this become in new ASA, tunnels up doesnt conccert this one .

thanks

Re: Need Assistance with Translating Old NAT 8.2 with new NAT statements in 9.6

Francesco Molino — Fri, 30 Aug 2019 23:43:53 GMT

Do you have a full tunnel for your vpn users? This means they access internet through the vpn tunnel.

If so you need a nat statement like:
Let's assume, your vpn pool subnet is 192.168.10.0/24.
Config will looks like:
Object network vpn
Subnet 192.168.10.0 255.255.255.0
nat (outside, outside) dynamic interface

And you need to enable the following command:
same-security-traffic permit intra-interface