nat conversion

[mickyq]

Hi

Im busy working through converting an 8.2 config to the new nat procedures.

can someone clarify if my interpretation of this nat is correct please.

8.2

nat (dmz) 0 10.1.1.0 255.255.255.0

8.4 upwards

object network OBJ-10.1.1.0-24

     subnet 10.1.1.0 255.255.255.0

nat (dmz,any) after-auto source static OBJ-10.1.1.0-24 OBJ-10.1.1.0-24

Im placing it after any other nats in section 3.

[Pulkit Saxena]

Hi,

The new NAT statement that you are applying is a static translation to its own.

Please check this link for difference in statements in 8.2 and 8.3  and above :

https://supportforums.cisco.com/document/33921/asa-pre-83-83-nat-configuration-examples

Regards,

Pulkit Saxena

[Peter Koltl · Accepted solution]

nat (dmz,any) after-auto source static OBJ-10.1.1.0-24 OBJ-10.1.1.0-24

It's OK but I prefer section 1 (i. e. without after-auto)

However, noNAT / identity NAT statements should usually be restricted to RFC1918 destination subnets. Your example may not enable DMZ hosts' traffic to the Internet to be NATed.

[Henrik Grankvist · Accepted solution]

Hi

I haven't worked with NAT pre-8.2, so I'm not really comfortable with it.

But I think that in pre-8.2 NAT you did identity NAT because of NAT control, meaning you have to have a NAT statement or the traffic wont pass the ASA. That is not the case anymore. So if you want traffic to go from the DMZ to the inside you don't need a NAT statement for it.

So without knowing how your network looks like, I would say you do not need that NAT rule you are describing.

[mickyq]

Thanks for you replies guys.

I believe you are all correct.

What I think ill do is not apply this nat unless I come across any problems. I can then try applying it to section 1.

Thanks again.