5512 ASA Old NAT to new NAT Help please

[John Clausen]

Hello Everyone...

I was wondering if anyone could help translate these old NAT commands to the new NAT commands for a 5512-x ASA.

I guess I am having trouble wrapping my head around the whole thing and I don't program enough routers to really retain anything.

Here goes the old NAT:

nat-control
global (outside) 101 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 101 0.0.0.0 0.0.0.0
static (inside,outside) udp interface 5008 192.9.200.5 5008 netmask 255.255.255.255 
static (inside,outside) udp interface 5020 192.9.200.6 5020 netmask 255.255.255.255 

Thanks in advance for the help,

John

[Jouni Forss]

Hi,

We will need the output of this command

show access-list inside_nat0_outbound

Without we can not tell you the corresponding NAT0 configuration in new format.

The other NAT configurations can be done this way

Static PAT (Port Forward)

object network STATIC-PAT-UDP5008
 host 192.9.200.5
 nat (inside,outside) static interface service udp 5008 5008

object network STATIC-PAT-UDP5020
 host 192.9.200.6
 nat (inside,outside) static interface service udp 5020 5020

Dynamic PAT

nat (inside,outside) after-auto source dynamic any interface

Here is a link to a document I wrote in 2013 about the new NAT configuration format:

https://supportforums.cisco.com/document/132066/asa-nat-83-nat-operation-and-configuration-format-cli

Here is also a great document when you want to compare the old and the new configuration format:

https://supportforums.cisco.com/document/33921/asa-pre-83-83-nat-configuration-examples

Hope this helps :)

- Jouni

[John Clausen]

Here it the output to show access-list inside_nat0_outbound:

access-list inside_nat0_outbound; 1 elements; name hash: 0x467c8ce4
access-list inside_nat0_outbound line 1 extended permit ip 192.9.200.0 255.255.255.0 192.168.201.0 255.255.255.192 (hitcnt=0) 0xe928f53a

Thanks for your help!!

John

[Jouni Forss · Accepted solution]

Hi,

You can do that with

object network SUB-1
 subnet 192.9.200.0 255.255.255.0

object network SUB-2
 subnet 192.168.201.0 255.255.255.192

nat (inside,outside) source static SUB-1 SUB-1 destination static SUB-2 SUB-2

Hope this helps :)

Please do remember to mark a reply as the correct answer if it answered your question.

- Jouni

[nspasov]

I have used this tool in the past:

http://www.tunnelsup.com/nat-converter/

There are some other cool tools that you can find useful. As mentioned by Jouni, you will have to update your ACLs as well.

Thank you for rating helpful posts!