About varrao

varrao · ‎05-03-2013

Hi, In ASA 8.3 or above, the codes have changed considerably, and yes the no. of lines of configuration have also increased. In your particular case, the second option is definitely a better one, since it saves mores lines and yes both the options do the same thing: Object-group network Inside_Subs network-object 255.255.255.0 network-object 255.255.255.0 network-object 255.255.255.0 nat (inside,dmz) source static Inside_Subs Inside_Subs no-proxy-ARP route-enabled You can definitely use object-groups in your nats, saving some config. Thanks, Varun Rao Security Team, Cisco TAC

varrao · ‎01-10-2013

Hi, The nat that you are trying to do is only one to one nat, and it cannot be one to many. You cannot use static command for it. If it is to be one to many then you would have to use dynamic keyword for it, which would be your port address translation. Thanks, Varun Rao Security Team, Cisco TAC

varrao · ‎01-10-2013

No Issues you can rate the post if it helped you. Thanks, Varun Rao Security Team, Cisco TAC

varrao · ‎01-10-2013

No, you would not be able to access or ping the remote interface on the ASA, you would only be able to access the interface to which the remote pool is connected to. If you would like to do this, then you would need to create a VPN tunnel between the remote pool and the ASA. By design this would not be possible. Thanks, Varun Rao Security Team, Cisco TAC

varrao · ‎01-10-2013

Absolutely, the info above is in the case you are using failover(either active/passive or active/active) only. Thanks, Varun Rao Security Team, Cisco TAC

varrao · ‎01-10-2013

Which interface are you trying to access on the ASA from the remote lan pool. Thanks, Varun Rao Security Team, Cisco TAC

varrao · ‎01-10-2013

Hi Hemant, How are you doing!!!!! A few reasons that I can see in here: 1. In the 8.2 nat exempt, it was for traffic from your transit interface to a lower security interface and unidirectional. 2. The static was for DMZ and Pubilc interface traffic only and a very specific one. 3. In post 8.3, the nat exempt got converted to a destination nat which started redirecting all the traffic from the WAN back to the default gateway. Since the manual nats are bidirectional (if unidirectional not used) as compared to nat exempt in 8.2 which is unidirectional. So the issue lies with the 8.2 nat exempt, which had a very open ACL, whicvh when converted to 8.3 started causing a problem, since manual nat is always hit before the auto nat. Thanks, Varun Rao

varrao · ‎01-10-2013

There is not much difference in terms of performance and approach, both are correct and there is not going to be any difference in terms performance. What you need to make sure is the ease of understanding and less amount of programming needed. So I feel the second approach is the best approach and anyone having a look at your configuration can understand the logic behind it. Hope that helps. Thanks, Varun Rao Security Team, Cisco TAC

varrao · ‎01-10-2013

Hi Nils, If you are using ASA version 8.3 or later you do not need the same licenses on the two units, the license would be shared between the boxes, but if it is a version previous to 8.3 then you would definitely need identical licenses on the two boxes. Hope that helps. Thanks, Varun Rao Security Team, Cisco TAC

varrao · ‎01-10-2013

If you are trying to access it over the VPN, can you add the command "management-access inside' and then try doing. Thanks, Varun Rao Security Team, Cisco TAC

varrao · ‎01-08-2013

Hi Mahesh, You can follow this doc to troubleshoot the SSH and ASDM issues: https://supportforums.cisco.com/docs/DOC-13012 Hope that helps, Thanks, Varun Rao Security Team, Cisco TAC

varrao · ‎11-20-2012

Hi, What you might be missing is a nat command and also the command: same-security-traffic permit inter-interface If you can share your configuration or atleast the interface configuration, I can suggest you more specific configuration for it. Thanks, Varun Rao Security Team, Cisco TAC

varrao · ‎11-20-2012

Hi Chris, To test your failover you can put in any combination it does not put any load on your failover pair. It is a command to do a forcefu failover between firewalls and check the failover functionality. Thanks, Varun Rao Security Team, Cisco TAC

varrao · ‎10-03-2012

What is the platform you are using??? ASA, router?? Thanks, Varun Rao Security Team, Cisco TAC

varrao · ‎09-28-2012

If you add this nat, then all your DMZ should b able to access internet: nat (DMZ) 2 192.168.1.0 255.255.255.0 global (outside) 2 interface N also please remove the access-group: access-group internal out interface OUTSIDE It doesn't make sense to me. Thanks, Varun Rao Security Team, Cisco TAC

Date Registered	‎11-29-2010 01:11 AM
Date Last Visited	‎08-18-2017 04:00 AM
Total Messages Posted	2,230
Total Helpful Votes Received	1056

Best way to setup identity NAT on ASA 5...

ASA 8.4 NAT subnets to 1 IP Address

ASA 5510 licensing with HA and SSL

Unable to launch ASDM over WAN - Cisco ...

ASA 5510 licensing with HA and SSL

Unable to launch ASDM over WAN - Cisco ...

NAT issue on 8.4 but it was working fin...

Help with Class-map configuration - ZBF...

ASA 5510 licensing with HA and SSL

Unable to launch ASDM over WAN - Cisco ...

Unable to SSH ASA using IP works fine w...

NAT/routing issue from one subinterface...

Cisco ASA - Force Failover

Probably super simple...ACL/VLANs

Cisco 501 ASA/PIX configuration