topic Re: help with new NAT config in Network Security

help with new NAT config

matthewatt — Mon, 11 Mar 2019 22:33:47 GMT

I'm struggling to get my NAT working as I am upgrading from a PIX to an ASA running 8.4. I'm trying to duplicate the following that was taken from the PIX:

PIX NAT shown here:

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

global (outside) 1 interface

global (outside) 1 x.x.x.x

On the ASA, I did the following:

object network obj_any
subnet 0.0.0.0 0.0.0.0
nat (inside,outside) dynamic interface

And then I added the command below and it overrode my first command

nat (inside,outside) dynamic x.x.x.x

I'm not quite sure how to get it to PAT to the interface, and also use a specific IP for a backup overload. In any case, I tried to remove the last nat that was applied and got this error:

FW(config)# no nat (inside,outside) dynamic x.x.x.x

no nat (inside,outside) dynamic x.x.x.x
^
ERROR: % Invalid input detected at '^' marker.

I can't seem to remove this NAT. When I try to put my first NAT back in place, I get:

FW(config)# nat (inside,outside) dynamic interface
^
ERROR: % Invalid input detected at '^' marker.

what am I doing wrong here? If I can't specify both and interface and an ip for the NAT, I can live with that. However, I prefer I use the interface rather than the specific ip if I can only use one. But I can't seem to get it removed. I don't dare use the "clear configure nat" command as I have a whole bunch of static NAT in place that I don't want to have to re-enter.

Re: help with new NAT config

Marvin Rhoads — Wed, 22 Feb 2012 17:56:33 GMT

I believe your inability to use the "no..." command is because you are trying to remove an object NAT rule. You need to enter that command from within the network object configuration mode (as oppposed to the global mode). Reference

So go back into config mode, then enter the command "object network obj_any". You should have a prompt that looks something like:

hostname(config-network-object)#

Then you should be able to do the "no nat... " command.

Re: help with new NAT config

matthewatt — Wed, 22 Feb 2012 18:14:58 GMT

Thanks for that. I knew it had to be something simple I was missing!

Does anyone know if you can continue to put in a nat statement on the new code that will give me the same as the following does on a PIX?

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

global (outside) 1 interface

global (outside) 1 x.x.x.x

Re: help with new NAT config

Julio Carvajal — Wed, 22 Feb 2012 18:25:55 GMT

Yes, You can

It will be

nat (inside,outside) source dynamic any interface

Regards,

Do rate helpful posts.

Julio

Re: help with new NAT config

matthewatt — Thu, 23 Feb 2012 13:52:38 GMT

I don't understand how that gives me the ability to PAT to the interface as well as a separate IP address, defined as x.x.x.x in my example. As I don't see reference to an IP address in your example, how can your command be provding that?

Re: help with new NAT config

Marvin Rhoads — Thu, 23 Feb 2012 21:21:17 GMT

The examples I have seen usually specify using an address (or address range) for the dynamic NAT with the interface as a PAT fallback. See for example here.