topic Logging and nat rules question in Network Security

Logging and nat rules question

carl_townshend — Mon, 11 Mar 2019 23:08:55 GMT

Hi all

I have an asa with the latest asdm. I have 2 questions

When doing a no Nat rule between 2 destinations, do I create a nat rule with my source and destination, then in the bottom box keep both as original ? How do I know if nat control is enabled on the GUI ?

I need to see some logs for something that is getting denied, on the bottom of each acl I don't see the implicit deny rule, do i need to create one at the bottom of my acl in question and turn logging to debugging?

Many thanks

Logging and nat rules question

Julio Carvajal — Sat, 19 May 2012 03:28:43 GMT

Hello Carl,

Is the requirement to know it via ASDM or can it be via CLI.

If CLI I can help you right now.

Do a sh run nat-control ( If you are running a version higher than 8.3 nat control will be disabled by default)

Regarding the not nat Rule, Yes you have to let them original.

Now regarding the ACL in order to log it you need to create it ( By default the implicit deny will not generate a log)

Regards,

Do rate all the helpful posts

Julio

Cisco Security Engineer

Logging and nat rules question

carl_townshend — Sat, 19 May 2012 09:32:03 GMT

so if we run 8.4 then is trafic allowed to flow throught he device without nat by default ?

also with the logging messages, so are you saying that i need to create an implicit deny under each of my access lists to see the deny logs ?

cheers

Logging and nat rules question

Julio Carvajal — Sat, 19 May 2012 19:10:04 GMT

Hello Carl,

from 8.3 to new versions Nat control is disabled, so if a packet from a higher security level wants to go to a lower version

there is no need for a NAT statement as required on 8.2 or lower versions.

If you want to see the deny logs yes you will need to do that.

Regards,

DO Rate all the helpful posts

Julio

Logging and nat rules question

carl_townshend — Mon, 21 May 2012 11:37:22 GMT

Hi There

what about if traffic say from outside (low security interface) needs access to a host in the inside (high security) interface, do we need to do configure a nat exemption for this ?

Many thanks

Carl

Logging and nat rules question

Julio Carvajal — Mon, 21 May 2012 17:36:08 GMT

Hello Carl,

Not at all you do not need that, but if you have a private ip address for the internal host you will need to nat it to the outside world to make it routable... but that is common sense.

It is not required to used it ( if you have on the inside interface public ip addresses then you will not need to do the NAT)

Hope this helps.

Please let me know if you have any other question if not please mark the question as answered.

Regards,

Julio