topic Dynamic NAT on ASA 8.2 in Network Security

Dynamic NAT on ASA 8.2

jasonww04 — Mon, 11 Mar 2019 22:31:38 GMT

I can't figure out why the ASA cannot send traffic to the internet with the below config. What did I do wrong?

interface Ethernet0/0

nameif Outside

security-level 0

ip address 4.28.x.x 255.255.255.252

interface Ethernet0/3

nameif Inside

security-level 100

ip address 172.18.170.1 255.255.255.0

access-list VibraRemote_splitTunnelAcl standard permit 172.18.170.0 255.255.255.0

access-list Inside_nat0_outbound extended permit ip 172.18.170.0 255.255.255.0 Level3-SIP 255.255.255.0

access-list Inside_nat0_outbound extended permit ip Level3-SIP 255.255.255.0 172.18.170.0 255.255.255.0

access-list Inside_nat0_outbound extended permit ip 172.18.170.0 255.255.255.0 4.28.x.x 255.255.255.252

access-list Inside_nat0_outbound extended permit ip 172.18.170.0 255.255.255.0 172.18.170.0 255.255.255.0

access-list Inside_nat0_outbound extended permit ip 172.18.170.0 255.255.255.0 Corporate 255.255.255.0

access-list Inside_nat0_outbound extended permit ip 172.18.170.0 255.255.255.0 Poway 255.255.255.0

access-list Inside_nat0_outbound extended permit ip 172.18.170.0 255.255.255.0 LaSierra 255.255.255.0

access-list Inside_nat0_outbound extended permit ip 172.18.170.0 255.255.255.0 Fontana 255.255.255.0

access-list Inside_nat0_outbound extended permit ip 172.18.170.0 255.255.255.0 MorenoValley 255.255.255.0

access-list Inside_nat0_outbound extended permit ip 172.18.170.0 255.255.255.0 Woodcrest 255.255.255.0

access-list Inside_nat0_outbound extended permit ip 172.18.170.0 255.255.255.0 HighDesert 255.255.255.0

access-list Inside_nat0_outbound extended permit ip 172.18.170.0 255.255.255.0 172.18.193.0 255.255.255.0

access-list Inside_nat0_outbound extended permit ip 172.18.170.0 255.255.255.0 Westminster 255.255.255.0

access-list Inside_nat0_outbound extended permit ip 172.18.170.0 255.255.255.0 Lakewood 255.255.255.0

global (Outside) 1 interface

nat (Inside) 0 access-list Inside_nat0_outbound

nat (Inside) 1 0.0.0.0 0.0.0.0

route Outside 0.0.0.0 0.0.0.0 4.28.x.x 1

route Inside Level3-SIP 255.255.255.0 172.18.170.3 1

Dynamic NAT on ASA 8.2

Patrick0711 — Fri, 17 Feb 2012 19:18:58 GMT

Are there any NAT 0 access lists that specify the destination you're tryin to reach? The PAT configuration is correct. Try a packet tracer and see what NAT configurations it hits

Dynamic NAT on ASA 8.2

jasonww04 — Fri, 17 Feb 2012 19:30:48 GMT

There aren't but the line

access-list Inside_nat0_outbound extended permit ip 172.18.170.0 255.255.255.0 4.28.x.x 255.255.255.252

is the network for my ISP.

I took it out and I still can't ping. I'm trying "ping Inside 75.71.47.74"

Dynamic NAT on ASA 8.2

Julio Carvajal — Sat, 18 Feb 2012 03:23:19 GMT

Hello Jason,

As I can see on the first post, You want to be able to go to the outside:

So on the No_nat rules you only need the networks for the VPN, nothing more.

Also access-list Inside_nat0_outbound extended permit ip 172.18.170.0 255.255.255.0 4.28.x.x 255.255.255.252

is the network for my ISP

Why are you doing that??? I mean traffic should get nat it, dont you think-

Dynamic NAT on ASA 8.2

Patrick0711 — Sat, 18 Feb 2012 03:28:19 GMT

Why are you performing a "ping Inside 75.71.47.74"? This command is sourcing a ping from the inside interface which is exempt from NAT so I would expect this to be PAT'd

Dynamic NAT on ASA 8.2

Patrick0711 — Sat, 18 Feb 2012 03:29:10 GMT

Err, I meant to say that I would expect that traffic NOT to be PAT'd

Dynamic NAT on ASA 8.2

jasonww04 — Mon, 20 Feb 2012 15:26:20 GMT

This is what my ACL looks like now and still users can't get out.