topic Re: 8.3 policy nat in Network Security

8.3 policy nat

WILLIAM STEGMAN — Mon, 11 Mar 2019 18:06:27 GMT

Hi, I'm trying to convert a policy nat entry from 8.0.x to 8.3

and am hoping someone can check my config.

My old config:

access-list PNAT-A10 remark any Internet hosts to DMZ A10 hosted servers
access-list PNAT-A10 extended permit ip any host 23.23.25.25 (Public IP)

nat (outside) 2 access-list PNAT-A10 outside

global (CustDMZ_1) 2 10.21.5.5 netmask 255.255.255.255

New config:

object network AXA-Citrix-A10_10.21.5.13

host 10.21.5.13
nat (CustDMZ_1,outside) static 23.23.25.25

object network obj-10.21.5.5
host 10.21.5.5

nat (CustDMZ_1,outside) source dynamic any obj-10.21.5.5 destination static AXA-Citrix-A10_10.21.5.13 AXA-Citrix-A10_10.21.5.13

Is this right? I want to make Internet clients appear as 10.21.5.5 when they hit the public address 23.23.25.25.

thank you,

Bill

Re: 8.3 policy nat

Jennifer Halim — Thu, 01 Jul 2010 23:35:22 GMT

You are almost right, the interfaces on the NAT statement is the other way round and the destination should be the public ip address instead of the real ip address. It should be as follows:

object network AXA-Citrix-A10_23.23.25.25

host 23.23.25.25

nat (outside,CustDMZ_1) source dynamic any obj-10.21.5.5 destination static AXA-Citrix-A10_23.23.25.25 AXA-Citrix-A10_23.23.25.25

Hope that helps.

Re: 8.3 policy nat

WILLIAM STEGMAN — Fri, 02 Jul 2010 13:55:53 GMT

How does the ASA know how to nat the public IP to the real address, 10.21.5.13, of the AXA-Citrix-A10 host? Wouldn't I have to create the object and add the real IP somewhere?

Re: 8.3 policy nat

WILLIAM STEGMAN — Fri, 02 Jul 2010 15:26:50 GMT

Could I also ask how disabled split tunneling traffic is now handled so VPN users use the Corporate Internet link?

Old config:

nat (outside) 1 192.168.1.0 255.255.255.0

global (outside) 1 interface

New config:

object network RAVPN_192.168.1.0

subnet 192.168.1.0 255.255.255.0

nat (outside,outside) dynamic interface

thanks again

Re: 8.3 policy nat

Jennifer Halim — Fri, 02 Jul 2010 23:08:02 GMT

Yes, you already have the configuration to statically translate the server to a public ip address.

Here is the config:

object network AXA-Citrix-A10_10.21.5.13

host 10.21.5.13
nat (CustDMZ_1,outside) static 23.23.25.25

Re: 8.3 policy nat

Jennifer Halim — Fri, 02 Jul 2010 23:09:12 GMT

Yes, the following config posted is correct:

object network RAVPN_192.168.1.0

subnet 192.168.1.0 255.255.255.0

nat (outside,outside) dynamic interface

Re: 8.3 policy nat

WILLIAM STEGMAN — Sat, 03 Jul 2010 01:39:20 GMT

thank you for your help.

Re: 8.3 policy nat

Jorge Salas — Sat, 03 Jul 2010 04:23:51 GMT

Also you can check this document as a reference:

Cisco ASA 5500 Migration Guide for Version 8.3

http://www.cisco.com/en/US/docs/security/asa/asa83/upgrading/migrating.html