topic NAT question for ASA running 8.4(5) in Network Security

NAT question for ASA running 8.4(5)

baskervi — Fri, 21 Feb 2020 12:49:27 GMT

We have a client who is about to hang an ASA off the DMZ of our firewall that is running 8.4(5). That firewall is currently on a different part of our network, and NAT is going to be significantly changed. Now, everything on the clients firewall needs to be NATed on the outside to the same as the internal IP scheme, e.g. like the old "static (inside,outside) 172.16.16.0 172.16.16.0 netm 255.255.255.0" command.

When I look at Cisco's document for NAT conversion (

http://www.cisco.com/en/US/docs/security/asa/asa83/upgrading/migrating.html#wp96828), I don't see any conversion between the two. This isn't a "nat 0" because Internet users will need access to some hosts on the inside of our client's firewall.

Can someone please point me in the right direction? Thanks

Re: NAT question for ASA running 8.4(5)

baskervi — Fri, 25 Jan 2013 07:01:52 GMT

Will the following work:

nat (inside,outside) source static any any

Re: NAT question for ASA running 8.4(5)

Jouni Forss — Fri, 25 Jan 2013 21:12:09 GMT

Hi,

Lets assume that the following is true

The new ASA has "inside" and "outside" network/interface only
The new ASA doesnt have to do ANY NAT from "inside" to "outside" traffic at any situation (your firewall handles this?)

Then you can simply have the ASA with absolutely NO NAT configurations. The ASA with the new software versions 8.3 and above automatically passes all traffic UNNATED through the ASA. We use this on one customer and it works just fine.

Please let me know if the above is the case or if not can think of something else

- Jouni

Re: NAT question for ASA running 8.4(5)

baskervi — Fri, 25 Jan 2013 23:09:23 GMT

With the previous versions of firmware, with "nat (inside) 0" and "global outside" commands, you couldn't initiate traffic from the outside to the inside. We will need to do this. So I can simply remove all NAT commands, and it will work fine?

NAT question for ASA running 8.4(5)

Jouni Forss — Sat, 26 Jan 2013 01:35:56 GMT

Hi,

Yes, we have a customer firewall (behind the actual Internet firewall) that has absolutely no NAT configurations. Its only doing access control with ACLs acting as a border between 2 local network segments.

- Jouni

NAT question for ASA running 8.4(5)

baskervi — Sat, 26 Jan 2013 14:25:13 GMT

JouniForss, thanks for your help!