ASA- Dynamic NAT- PAT

[miracle_david@yahoo.com]

Hi gentlemen,

I need configuration for these 2 scenarios ASA- Dynamic NAT & PAT. Can somebody provide me with links to these scenarios please.

P.S: I have another question about ASA:  why ICMP & Traceroute commands are disabled for inspection by default.

Thanks in advance

[Seb Rupik · Accepted solution]

Hi there,

the following document covers the scenarios you mention:

https://www.cisco.com/c/en/us/td/docs/security/asa/asa96/configuration/firewall/asa-96-firewall-config/nat-reference.html

Regarding ICMP and traceroute, both use stateless packets, something that the ASA doesn't track by default. My guess as to why inspection is disabled by default instead of tracking the packets would be to prevent the firewall from overwhelmed by that packet type.

cheers,

Seb.

[miracle_david@yahoo.com]

Seb Rupik 

Do u mean its because of security reason?

[Seb Rupik]

Yes, its not a good idea to make your security device susceptible to denial of service type attack.

[miracle_david@yahoo.com]

Thanks for your great reply. Do u have any link for "GETVPN coops" & multicast scenarios please?

[Seb Rupik]

The ASA does not support GETVPN. For multicast guides the ASA CLI configuration books are a good place to start:

https://www.cisco.com/c/en/us/td/docs/security/asa/asa96/configuration/general/asa-96-general-config/route-multicast.html

[miracle_david@yahoo.com]

@Seb Rupik
Hi again in the above mentioned link part "Different Translation Depending on the Destination Address and Port (Dynamic PAT)"
Web address is:129 while, Telnet address is 130.But in the explanations it says : "When the host accesses the server for Telnet services, the real address is translated to 209.165.202.129:port. When the host accesses the same server for web services, the real address is translated to 209.165.202.130:port." Is it a typo?

[Seb Rupik]

Yes, it is a typo. The diagram and config describe the same process. The leading paragraph need the translated outside IP address swapped around.

cheers,

Seb.