Object network nonat

[richard.schultz1]

Good morning all (or evening, however)

I have a question!

I am looking to create a nonat object that contains an object-group. Is this possible?

ASA version 8.6(1)2

object-group network awesome

 network-object host x.x.x.x

 network-object host x.x.x.y

nat (inside,outside) source static nonat(172.16.248.0-24) nonat(172.16.248.0-24) destination static nonat(awesome) nonat(awesome)

Well, when I go to create the nonat object there's no option for object-group. 

Curious if there's a different way to do this, if this is even necessary, or if I'm pipe dreaming.

[Vibhor Amrodia · Accepted solution]

Hi,

You can create a manual NAT and reference the Object Group in it:-

nat (inside,outside) source static obj-172.16.248.0-24 obj-172.16.248.0-24 destination static awesome awesome no-proxy-arp route-lookup

Refer:-

http://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/nat_objects.html

Thanks and Regards,

Vibhor Amrodia

[richard.schultz1]

Excellent!

That being said, how would that look reflected on the distant end running PIX 8.0(4)?

access-list nonat extended permit ip object-group awesome 172.16.248.0 255.255.255.0 

If the object-group awesome is in reference to a particular interface, would that look like.

Sorry, I'm a bit noobish. (and by a bit I mean quite)

[Vibhor Amrodia · Accepted solution]

Hi,

Converted statement for Pix 8.x would be:-

access-list nonat extended permit ip 172.16.248.0 255.255.255.0 object-group awesome

nat (inside) 0 access-list nonat

Thanks and Regards,

Vibhor Amrodia

[richard.schultz1]

Very good! Thank you so much!