PIX to ASA conversion

[mickyq]

Hi

Im manually converting PIX 8.2 config to ASA 9.1

The question I have is regarding static nats. eg:

static (outside,inside) 172.18.1.6 172.18.1.6 netmask 255.255.255.255

The old method was to basically no nat required traffic. I believe in the new ios this is not required. Can I leave out the config for all these static nats?

thanks

[Marvin Rhoads]

The convention of what order the interfaces are listed changed as of ASA 8.3+. That is why you see it reversed.

I tend to not use the auto-upgrade. I feel that a combination of third party tools and manual review gives a consistently better otucome. Have a look at the tools at tunnelsup.com. First check for unused objects, ACLs etc. and then remove them from your starting configuration.

https://www.tunnelsup.com/config-cleanup/

Then use the syntax conversion tool there.

https://www.tunnelsup.com/nat-converter/

As always, review the configuration to make sure you understand it. If I'm the one being called if anything goes wrong, I would much rather be prepared before that call comes. 

[mickyq]

Thanks Marvin

I have used the nat converter but I wasnt aware of the config-cleanup. Ive manually removed 0 hit acls, names and groups. It might have been useful to have that earlier but thanks for the links.

The original 8.2 config has a lot of static no nats. I believe the new ios doesnt need these as it will only nat traffic that is configured for nat. everything else will pass through as it is.

I just wanted confirmation of my understanding. 

I suppose i could configure them and remove them if they have no hits. Its just that theres quite a few of them.

cheers

[Marvin Rhoads]

You're welcome.

You are correct about the ASA not auto-natting (unless it's configured to do so). That behavior replaced the old "nat control" in 8.2 and earlier.

We still usually end up having identity NAT (or twice NAT as it's sometimes called) to override a more general dynamic NAT statement that is often used as a catch all for networks where the inside is all RFC 1918 address and the outside is public.

But as long as that or any more general NAT statement doesn't cause it to behave differently, an ASA with 8.3+ will not automatically NAT between interfaces.

You can always check your logic with packet-tracer.