topic Startup config error after upgrading to ASA from PIX in Network Security

Startup config error after upgrading to ASA from PIX

mark.kimzey — Tue, 12 Mar 2019 00:59:22 GMT

Hey guys. I get the following startup-config errors when reloading our ASA. A pix->asa conversion was just done on it. The ASA is currently running 8.2(5), and I am trying to get ready to update it to the most stable release, and wanted to make sure all my ducks are in a row. What is going on with the "will be identity translated for outbound"? This is part of the VPN configuration, and I understand nat0 is saying to not nat it. Is this something that I should be worried about? The ASA is not in production currently.

Let me know if you need further information

Thanks,

.........nat 0 10.37.0.116 will be identity translated for outbound

*** Output from config line 406, "nat (inside) 0 10.37.0.1..."

nat 0 xx.xx.xx.xx (PUBLIC IP) will be identity translated for outbound

*** Output from config line 431, "nat (inside) 0 xx.xx.xx..."

.........

Line 406

nat (inside) 0 10.37.0.116 255.255.255.255

Line 431

nat (inside) 0 xx.xx.xx.xx (PUBLIC IP) 255.255.255.255

Corresponding global

nat (outside) 0 access-list outside_inbound_nat0_acl outside

nat (inside) 0 access-list inside_outbound_nat0_acl

ACL

access-list outside_inbound_nat0_acl extended permit ip 172.16.16.0 255.255.255.0 any

access-list inside_outbound_nat0_acl extended permit ip any 172.16.16.0 255.255.255.0

access-list inside_outbound_nat0_acl extended permit ip 10.37.0.0 255.255.0.0 172.16.16.0 255.255.255.0

access-list inside_outbound_nat0_acl extended permit ip 172.31.0.0 255.255.0.0 172.16.16.0 255.255.255.0

Startup config error after upgrading to ASA from PIX

Jouni Forss — Tue, 12 Feb 2013 07:21:02 GMT

Hi,

I would imagine that there is no problem as the firewall has not given any kind of error message.

I do personally wonder sometimes why is it so (atleast in the 8.2 softares etc) that the firewall shows a message on the CLI when you are for example configuring a "global" / "nat" command pair.

I wonder if this falls into the same category.

The configuration format for NAT has stayed pretty same leading to the 8.2 softwares. I'm not totally sure what software you are going to go for but you seem to have the latest 8.2 series software so next steps are already 8.3 / 8.4 / 9.0 / 9.1

ALL of the above mentioned softwares introduce a completely new NAT configuration format to the ASA. While the ASA automatically converts the configurations its not always 100% process not to mention that the NAT configuration probably is far from optimal.

- Jouni

Startup config error after upgrading to ASA from PIX

mark.kimzey — Wed, 13 Feb 2013 05:23:43 GMT

Thanks for the confirmation. I got her to 8.45 for now and plan on deploying it this weekend.