topic Re: PAT Config post 8.2 in Network Security

PAT Config post 8.2

cyoung1981 — Fri, 21 Feb 2020 16:47:40 GMT

Hi All!

So I have avoided the new form of NAT config for as long as I can. I downgraded my ASA 5585-X to 8.2 to avoid it. But now I must get it up to the latest code. I have been searching, but to no avail, how to handle the PAT in this new form.

My current config of course has

global (outside) 1 interface
global (outside) 2 x.x.x.x

The new base config after loading ASA 9.10 has this

object network obj_any
 nat (any,outside) dynamic interface

Is this the new PAT config? How would I handle multiple PATs? I would assume creating object-groups with the networks I want to use in each pat?

object network obj_pub_2
1.1.1.1
object network ten
 subnet 10.0.0.0 255.255.255.0
object network one
 subnet 10.1.0.0 255.255.255.0
object network two
 subnet 10.2.0.0 255.255.255.0
object network three
 subnet 10.3.0.0 255.255.255.0
object-group network PAT_ONE
 network-object object ten
 network-object object one
object-group PAT_TWO
 network-object object two
 network-object object three
object-group PUB_TWO
 network-object object obj_pub_2
!
nat (inside,outside) after-auto source static PAT_ONE interface
nat (inside,outside) after-auto source static PAT_TWO PUB_TWO

Am I on the right track here?

Re: PAT Config post 8.2

Francesco Molino — Sun, 10 Feb 2019 02:47:37 GMT

Hi

You used nat command with source static which is wrong because you want to do PAT.

The config should be:

nat (inside,outside) after-auto source dynamic PAT_ONE interface
nat (inside,outside) after-auto source dynamic PAT_TWO PUB_TWO

If you want to validate the config you converted, you can use these tools:
- Cisco tool: https://fwm.cisco.com/auth.do
- Tunnelsup tool: https://www.tunnelsup.com/nat-converter/

Re: PAT Config post 8.2

cyoung1981 — Sun, 10 Feb 2019 02:50:02 GMT

Thanks so much! Everything else looks correct?

Re: PAT Config post 8.2

Francesco Molino — Sun, 10 Feb 2019 02:52:05 GMT

Objects yes.

Just a remark regarding the following nat:
object network obj_any
nat (any,outside) dynamic interface

Avoid using any and replace it with the real interface name.