topic Re: Debuging NAT on ASA in Network Security

Debuging NAT on ASA

SDWorx_2 — Mon, 11 Mar 2019 12:54:28 GMT

Hi,

I don't know this is possible (I can't find it how) but I would like to debug all translations the ASA performs. I would like to view in realtime all translations.

Show xlate is a way to view translations I guess, but it is not what I was looking for.

Is there any way I can get this done?

Thank you,

Jan

Re: Debuging NAT on ASA

smahbub — Mon, 09 Jun 2008 14:54:45 GMT

To display active Network Address Translation (NAT) translations, use the "show ip nat translations" command in EXEC mode.

Refer the following url for more info:

http://www.cisco.com/en/US/docs/ios/12_3/ipaddr/command/reference/ip1_s1g.html#wp1082204

Re: Debuging NAT on ASA

Collin Clark — Mon, 09 Jun 2008 15:11:24 GMT

Jan-

What Shumon suggested will only work on routers. With the new ASA's I have not been able to find a command to debug NAT.

Re: Debuging NAT on ASA

Amadou TOURE — Mon, 09 Jun 2008 15:44:31 GMT

show local-host, show connection could help even they're not exclusively related to NAT.

You could also use the command :

"logging list event_list message start" with the Message 202001 (out of translation slots) and messages 305009 through

305011 (translations built and torn down)

Regards

Re: Debuging NAT on ASA

Farrukh Haroon — Mon, 09 Jun 2008 19:20:58 GMT

I'm also unaware of any command that can help you debug NAT. You can use the following tough:

show xlate [det | debug]

show conn det [all]

show local-host [all]

show nat

Regards

Farrukh

Re: Debuging NAT on ASA

Rajendran N — Mon, 02 Oct 2017 05:41:10 GMT

I would like to inform you that this can be checked with the command :

“show xlate global <ip address>”

You can read more about it at the below link :

https://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/S/cmdref3/s14.html#pgfId-1336424