Cisco ASA 5505 nat

[lpazdern]

I'm running into an issue where we have an older Cisco ASA 5505. Needless to say, it's quite old and we want to replace it with a newer Cisco ASA 5585.

This ASA has been on the shelf for a couple of years so I'm pretty rusty with the Cisco stuff anymore. 

I'm running into an issue on the 5585 with these nat commands from the old config:

nat (city) 0 access-list city_nat0_outbound
nat (kps) 0 access-list kps_nat0_outbound

When I enter the commands one at a time, it seems to prompt me for the same thing, but still returns the error:

nat ?

configure mode commands/options:
( Open parenthesis for (<internal_if_name>,<external_if_name>)
pair where <internal_if_name> is the Internal or prenat
interface and <external_if_name> is the External or postnat
interface
<1-2147483647> Position of NAT rule within before auto section
after-auto Insert NAT rule after auto section
source Source NAT parameters

nat (city) ?

configure mode commands/options:
<0-2147483647> The <nat_id> of this group of hosts/networks. This <nat_id>
will be referenced by the global command to associate a
global pool with the local IP address. <nat_id> '0' is used
to indicate no address translation for local IP. The limit is
65535 with access-lists

nat (city) 0 ?

configure mode commands/options:
Hostname or A.B.C.D The hosts/networks in this <nat_id> group, '0' indicates
all networks or the default <nat_id> group
access-list Specify access-list name after this keyword

nat (city) 0 access-list ?

configure mode commands/options:
WORD Access-list name

nat (city) 0 access-list city_nat0_outbound
ERROR: This syntax of nat command has been deprecated.
Please refer to "help nat" command for more details.

Anyone have any hints on where I need to look in order to fix this?

[lpazdern]

Ok, So I logged into the 5505 via the ASDM, and I see this in the NAT rules:

Spoiler

So I looked in the interfaces and I'm not seeing this outbound interface:

So I guess I'm wondering if this is needed on the 5585 ASA? it appears that it is exempting these addresses and not really doing any NAT?

Like I said, I'm rusty on the Cisco stuff anymore so if someone could let me know if I'm barking up the wrong tree here, I greatly appreciate it?

[Rahul Govindan · Accepted solution]

Your ASA5505 seems to be running a version prior to 8.3. NAT configs and behavior have changed in 8.3 and above versions. 

Reference the below document and convert your ASA rules to port 8.3 config before adding into the new ASA:

https://supportforums.cisco.com/t5/security-documents/asa-pre-8-3-to-8-3-nat-configuration-examples/ta-p/3116375

[lpazdern]

Ok, Thanks for the link and information.. I checked the document in the link but I guess I'm not clear on what this statement on the ASA 5505 is actually doing?:

nat (city) 0 access-list city_nat0_outbound

If I run the command "show NAT city" on the old ASA 5505, it returns this:

show nat city
match ip city 192.168.1.0 255.255.255.0 city any
NAT exempt
translate_hits = 0, untranslate_hits = 0
match ip city PoliceCars 255.255.255.0 city any
NAT exempt
translate_hits = 0, untranslate_hits = 0
match ip city CommandPost 255.255.255.0 city any
NAT exempt
translate_hits = 0, untranslate_hits = 0
match ip city EOC 255.255.255.0 city any
NAT exempt
translate_hits = 0, untranslate_hits = 0
match ip city 192.168.1.0 255.255.255.0 kps any
NAT exempt
translate_hits = 180, untranslate_hits = 600
match ip city PoliceCars 255.255.255.0 kps any
NAT exempt
translate_hits = 0, untranslate_hits = 54
match ip city CommandPost 255.255.255.0 kps any
NAT exempt
translate_hits = 0, untranslate_hits = 0
match ip city EOC 255.255.255.0 kps any
NAT exempt
translate_hits = 0, untranslate_hits = 0
match ip city 192.168.1.0 255.255.255.0 _internal_loopback any
NAT exempt
translate_hits = 0, untranslate_hits = 0
match ip city PoliceCars 255.255.255.0 _internal_loopback any
NAT exempt
translate_hits = 0, untranslate_hits = 0
match ip city CommandPost 255.255.255.0 _internal_loopback any
NAT exempt
translate_hits = 0, untranslate_hits = 0
match ip city EOC 255.255.255.0 _internal_loopback any
NAT exempt
translate_hits = 0, untranslate_hits = 0

KPS-City-Firewall# show nat city
match ip city 192.168.1.0 255.255.255.0 city any
NAT exempt
translate_hits = 0, untranslate_hits = 0
match ip city PoliceCars 255.255.255.0 city any
NAT exempt
translate_hits = 0, untranslate_hits = 0
match ip city CommandPost 255.255.255.0 city any
NAT exempt
translate_hits = 0, untranslate_hits = 0
match ip city EOC 255.255.255.0 city any
NAT exempt
translate_hits = 0, untranslate_hits = 0
match ip city 192.168.1.0 255.255.255.0 kps any
NAT exempt
translate_hits = 180, untranslate_hits = 600
match ip city PoliceCars 255.255.255.0 kps any
NAT exempt
translate_hits = 0, untranslate_hits = 54
match ip city CommandPost 255.255.255.0 kps any
NAT exempt
translate_hits = 0, untranslate_hits = 0
match ip city EOC 255.255.255.0 kps any
NAT exempt
translate_hits = 0, untranslate_hits = 0
match ip city 192.168.1.0 255.255.255.0 _internal_loopback any
NAT exempt
translate_hits = 0, untranslate_hits = 0
match ip city PoliceCars 255.255.255.0 _internal_loopback any
NAT exempt
translate_hits = 0, untranslate_hits = 0
match ip city CommandPost 255.255.255.0 _internal_loopback any
NAT exempt
translate_hits = 0, untranslate_hits = 0
match ip city EOC 255.255.255.0 _internal_loopback any
NAT exempt
translate_hits = 0, untranslate_hits = 0
KPS-City-Firewall# show nat kps
match ip kps host VSAM-KH city any
NAT exempt
translate_hits = 0, untranslate_hits = 73
match ip kps host VSAM-BH city any
NAT exempt
translate_hits = 3, untranslate_hits = 40
match ip kps host VSAM-KH kps any
NAT exempt
translate_hits = 0, untranslate_hits = 0
match ip kps host VSAM-BH kps any
NAT exempt
translate_hits = 0, untranslate_hits = 0
match ip kps host VSAM-KH _internal_loopback any
NAT exempt
translate_hits = 0, untranslate_hits = 0
match ip kps host VSAM-BH _internal_loopback any
NAT exempt
translate_hits = 0, untranslate_hits = 0

I'm not seeing any actual NAT IP's or NAT translations, so if all the statement from the 5505 is doing is exempting everything from NAT, is this really needed on the ASA 5585?

Or do I need to run a different command on the ASA 5505 to find the actual NAT translation's ?

[lpazdern]

Ok, so if I understand this correctly, i think all the old exempt rules were doing was a NAT from the IP's in the "city" list" to the specific interface, either "city" or "kps". I'm going to go ahead and do a PAT on the 5585 and I'll mark Rahul's reply as the solution.