topic Re: ASA post ver8.2 Static NAT & Name Command in Network Security

ASA post ver8.2 Static NAT & Name Command

jfwarren1 — Tue, 12 Mar 2019 03:44:36 GMT

Hello, pre 8.3 I would use the Name Command and static map a public IP to a private IP as follows:

name 12.236.93.72 InsideHost

static (inside,outside) InsideHost 10.11.10.1 netmask 255.255.255.255

Post ver8.2 I realize that command has changed to the object network command but does not work with the name. I recieve the following error:

name 12.236.93.72 InsideHost

object network obj-10.11.10.1

host 10.11.10.1

nat (inside,outside) static InsideHost

ERROR: InsideHost Dosn't Exist

I cannot find the Name Command in the newer post8.2 documentation.

ASA post ver8.2 Static NAT & Name Command

Jouni Forss — Wed, 12 Feb 2014 19:33:58 GMT

Hi,

Its my understanding that the "name" configuration doesnt really play much of a role in the new ASA software levels and the "object" has atleast partially replaced that.

Do notice that you can create an "object" for the IP address 12.236.93.72

object network Insidehost

host 12.236.93.72

object network obj-10.11.10.1

host 10.11.10.1

nat (inside,outside) static Insidehost

But to be honest I have never liked the "name" configuration and have always disabled it on the ASAs I manage. When I am troubleshooting something or making new rules I want to do it based on the actual IP rather than a "name" but I guess its matter of taste/personal preference.

Also I dont use the above method either. I simply define the IP address in the section where you define the NAT IP address. This keeps the configuration clearer and less cluttered with "object" or "object-group"

Hope this helps

- Jouni

ASA post ver8.2 Static NAT & Name Command

mvsheik123 — Wed, 12 Feb 2014 19:37:59 GMT

Hi,

Post 8.2 (8.3 and above) 'name' command changed to 'object network'. So you need to create another object network similar to your private ip.

EX:

object network public-10.11.10.1

host 12.236.93.72

object network obj-10.11.10.1

host 10.11.10.1

nat (inside,outside) static public-10.11.10.1

Check the below link (search for key word 'name')

http://www.cisco.com/c/en/us/td/docs/security/asa/asa83/upgrading/migrating.html#wp106866

hth

Re: ASA post ver8.2 Static NAT & Name Command

Jouni Forss — Wed, 12 Feb 2014 19:39:12 GMT

Hi,

This is from the Command Reference the thing I referenced above

This is the change introduced when the NAT configuration format changed at 8.3(1)

8.3(1) You can no longer use a named IP address in a nat command or an access-list

command; you must use object network names instead. Although

network-object commands in an object group accept object network

names, you can still also use a named IP address identified by the name

command.

- Jouni

Re: ASA post ver8.2 Static NAT & Name Command

jfwarren1 — Wed, 12 Feb 2014 19:48:51 GMT

Thanks so much!!!

ASA post ver8.2 Static NAT & Name Command

Jouni Forss — Wed, 12 Feb 2014 19:51:06 GMT

Hi,

Glad if it helped

Please do remember to mark a reply as the correct answer if it answered your question.

- Jouni