Hi,
The configuration guide for 8.2 software would lead to believe that the order of those 2 "global" lines has no effect on how the "global" configurations are used. Which leads me to believe this is just how the ASA handles when it has both a single IP address and range of IP address with the same ID number in the configurations.
This is how the 8.2 Configuration Guide instructs to configure the NAT Pool + PAT you mention
To identify a pool of addresses for dynamic NAT as well as a PAT address for when the NAT pool is
exhausted, enter the following commands:
hostname(config)# nat (inside) 1 10.1.1.0 255.255.255.0
hostname(config)# global (outside) 1 209.165.201.5
hostname(config)# global (outside) 1 209.165.201.10-209.165.201.20
Notice that the actual configuration guide has the PAT address defined first before the actual range of IP address.
It also mentions the following
You can enter multiple global commands for one interface using the same NAT ID; the ASA uses the
dynamic NAT global commands first, in the order they are in the configuration, and then it uses the PAT
global commands in order. You might want to enter both a dynamic NAT global command and a PAT
global command if you need to use dynamic NAT for a particular application, but you should have a
backup PAT statement in case all the dynamic NAT addresses are depleted. Similarly, you might enter
two PAT statements if you need more than the approximately 64,000 PAT sessions that a single PAT
mapped statement supports
Which I interpret in the following way
- Firs the ASA uses the Dynamic NAT Pools configured on the ASA in the order they are configured in (This would mean whatever order the PAT and Pool addresses were configured the Pool would always be used first
- Right after the above it states that after NAT Pools, the PAT addresses are used in the order they are configured
- All of the above would lead me to believe that its just how the ASA handles the NAT. If there is a NAT Pool configured, it uses it first. If it runs out it uses the PAT address.
Now related to the new 8.3 (and after) format
This is how I configure the NAT Pool + PAT
object-group network SOURCE-NETWORKS
network-object 10.10.10.0 255.255.255.0
network-object 10.10.20.0 255.255.255.0
object network PAT-ADDRESS
host 1.1.1.1
object network NAT-POOL
range 1.1.1.2 1.1.1.253
object-group network NAT-POOL+PAT
network-object object NAT-POOL
network-object object PAT-ADDRESS
nat (any,WAN) after-auto source dynamic SOURCE-NETWORKS NAT-POOL+PAT
Though you could naturally have the "interface" keyword in use here but since I was testing with a "dummy" NAT Pool + PAT I didnt use my own ASAs "WAN" interface IP address.
I would imagine even though the NAT+PAT format is different it still handles the ordering of the NAT IP addresses used in the same way. Which would be NAT Pool before PAT.
Now to the question about how does the ASA know to use the "outside" interface IP address as the PAT fallback address when the NAT Pool has run out. I would have to again guess that this has to do with the same thing mentioned above for the older software. The ASA is just simply setup to use the NAT Pool first then use the interface IP address as the PAT translation fallback. I dont think even the Cisco material gives really specific information on how the NAT operates while it does have alot of information. Sometimes I do find things that I had no idea about and thats partly the reason I am on these forums also. Never know when you run into something new which you can use yourself.
On the question why does the ASA still need source addresses specified when the interface is already set as "any". I again imagine this is just how the NAT is set up to work.
Notice that when you are using Network Object NAT like you are in your above example, the "object network" always defines the source address.
Even if you were to configure Manual NAT / Twice NAT (or whatever the correct term is nowadays) then the device would still force you to specify the source network. (Even if it was just "any")
For example it could be something like this
nat (any,WAN) after-auto source dynamic any NAT-POOL interface
Where we have
- Source interface as "any"
- But still have to configure the "source" parameters for the actual source IP addresses. In this case that is also specified as "any".
Dont know if there answer any of your questions to the degree you would want. To be honest I wanted to check some things out myself and might as well write it up here too.
- Jouni
