topic ASA 5505 nat in Network Security

ASA 5505 nat

marktaylor47 — Mon, 11 Mar 2019 23:52:57 GMT

I have a 5505 between a vendor router & my company network, vendor is not able to access devices on internal network. I am also not able to access the firewall via asdm, please see attached config.

thanks

ASA 5505 nat

varrao — Wed, 12 Sep 2012 03:32:39 GMT

Hi Mark,

You are using a very old incompatible version of ASDM, you woudl need to upgrade the ASDM to the latest 6.4.9, and yours is:

asdm image disk0:/asdm-524.bin

There is no configuration in teh file which would give access of your internal network to the outside vendor, what machines does the vendor need to access?? You would need to put a NAT for it.

Hope that helps.

Thanks,
Varun Rao
Security Team,
Cisco TAC

ASA 5505 nat

marktaylor47 — Wed, 12 Sep 2012 11:43:40 GMT

Hi Varun,

Vendor need access to servers on 10.1.1.0 & 10.88.10.0 networks, new to firewalls, can you give an example of nat.

thanks

ASA 5505 nat

varrao — Wed, 12 Sep 2012 11:59:43 GMT

You can definitely give this a try:

object network vendor_network

subnet xx.xx.xx.xx

object network network_1

subnet 10.1.1.0 255.255.255.0

object network network_2

subnet 10.88.10.0 255.255.255.0

nat (outside,inside) source static vendor_network vendor_network destination static network_1 network_1

nat (outside,inside) source static vendor_network vendor_network destination static network_2 network_2

access-list external extended permit ip 10.1.1.0 255.255.255.0

access-list external extended permit ip 10.88.10.0 255.255.255.0

access-group external in interface outside

This should work.

Thanks,

Varun Rao
Security Team,
Cisco TAC

ASA 5505 nat

marktaylor47 — Wed, 12 Sep 2012 14:32:32 GMT

Hi varun,

Thank you for the reply, vendor has many networks & I found out that they will be accessing a
single server 10.1.1.6, I have made following changes

!
object-group network vendor_network
network-object 10.160.8.0 255.255.255.0
network-object 10.194.5.0 255.255.255.0
network-object 10.196.8.0 255.255.255.0
network-object 10.216.28.0 255.255.255.0
!
object network network_1
subnet 10.1.1.6 255.255.255.255
!
nat (outside,inside) source static vendor_network vendor_network destination static network_1 network_1
!
access-list external extended permit ip host 10.1.1.6 - entry for each vendor network
!

Please let me know if changes will work.

thanks

ASA 5505 nat

varrao — Wed, 12 Sep 2012 14:35:59 GMT

Yes, it is the correct configuration that you would need.

Thanks,
Varun Rao
Security Team,
Cisco TAC

ASA 5505 nat

marktaylor47 — Wed, 12 Sep 2012 14:42:43 GMT

Hi Varun,

thanks again for your help, I will be applying the changes tomorrow & let you know.

regards

ASA 5505 nat

marktaylor47 — Wed, 12 Sep 2012 15:44:10 GMT

Hi Varun,

do I have to remove following:

nat (inside,outside) source dynamic Inside_Internal interface

thnks

ASA 5505 nat

varrao — Wed, 12 Sep 2012 15:46:08 GMT

Hi Mark,

No you need not remove it, thats for internal users to access outside resources.

Thanks,
Varun Rao
Security Team,
Cisco TAC

ASA 5505 nat

marktaylor47 — Wed, 12 Sep 2012 17:18:17 GMT

Hi Varun,

I started ASDM, it gave me an error message to downgrade to 8.2 as not enough RAM. I downgraded & nat statements are gone, I tried to add but it doesn't give me the options, what will be the config for 8.2(5) ?

thanks

ASA 5505 nat

marktaylor47 — Thu, 13 Sep 2012 10:57:35 GMT

Hi Varun,

please send nat for 8.2.5.

thanks