Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About varrao
08-18-2017
varrao
Member since
11-29-2010
Engager
CCIE Security# 37297
05-03-2013
02:26 PM
Hi, In ASA 8.3 or above, the codes have changed considerably, and yes the no. of lines of configuration have also increased. In your particular case, the second option is definitely a better one, since it saves mores lines and yes both the options do the same thing: Object-group network Inside_Subs network-object 255.255.255.0 network-object 255.255.255.0 network-object 255.255.255.0 nat (inside,dmz) source static Inside_Subs Inside_Subs no-proxy-ARP route-enabled You can definitely use object-groups in your nats, saving some config. Thanks, Varun Rao Security Team, Cisco TAC
... View more
01-10-2013
05:34 PM
Hi, The nat that you are trying to do is only one to one nat, and it cannot be one to many. You cannot use static command for it. If it is to be one to many then you would have to use dynamic keyword for it, which would be your port address translation. Thanks, Varun Rao Security Team, Cisco TAC
... View more
01-10-2013
07:18 AM
No Issues you can rate the post if it helped you. Thanks, Varun Rao Security Team, Cisco TAC
... View more
01-10-2013
06:26 AM
No, you would not be able to access or ping the remote interface on the ASA, you would only be able to access the interface to which the remote pool is connected to. If you would like to do this, then you would need to create a VPN tunnel between the remote pool and the ASA. By design this would not be possible. Thanks, Varun Rao Security Team, Cisco TAC
... View more
01-10-2013
06:18 AM
Absolutely, the info above is in the case you are using failover(either active/passive or active/active) only. Thanks, Varun Rao Security Team, Cisco TAC
... View more
01-10-2013
06:17 AM
Which interface are you trying to access on the ASA from the remote lan pool. Thanks, Varun Rao Security Team, Cisco TAC
... View more
01-10-2013
06:16 AM
Hi Hemant, How are you doing!!!!! A few reasons that I can see in here: 1. In the 8.2 nat exempt, it was for traffic from your transit interface to a lower security interface and unidirectional. 2. The static was for DMZ and Pubilc interface traffic only and a very specific one. 3. In post 8.3, the nat exempt got converted to a destination nat which started redirecting all the traffic from the WAN back to the default gateway. Since the manual nats are bidirectional (if unidirectional not used) as compared to nat exempt in 8.2 which is unidirectional. So the issue lies with the 8.2 nat exempt, which had a very open ACL, whicvh when converted to 8.3 started causing a problem, since manual nat is always hit before the auto nat. Thanks, Varun Rao
... View more
01-10-2013
06:06 AM
There is not much difference in terms of performance and approach, both are correct and there is not going to be any difference in terms performance. What you need to make sure is the ease of understanding and less amount of programming needed. So I feel the second approach is the best approach and anyone having a look at your configuration can understand the logic behind it. Hope that helps. Thanks, Varun Rao Security Team, Cisco TAC
... View more
01-10-2013
06:02 AM
Hi Nils, If you are using ASA version 8.3 or later you do not need the same licenses on the two units, the license would be shared between the boxes, but if it is a version previous to 8.3 then you would definitely need identical licenses on the two boxes. Hope that helps. Thanks, Varun Rao Security Team, Cisco TAC
... View more
01-10-2013
06:00 AM
If you are trying to access it over the VPN, can you add the command "management-access inside' and then try doing. Thanks, Varun Rao Security Team, Cisco TAC
... View more
01-08-2013
12:49 PM
Hi Mahesh, You can follow this doc to troubleshoot the SSH and ASDM issues: https://supportforums.cisco.com/docs/DOC-13012 Hope that helps, Thanks, Varun Rao Security Team, Cisco TAC
... View more
11-20-2012
05:58 PM
Hi, What you might be missing is a nat command and also the command: same-security-traffic permit inter-interface If you can share your configuration or atleast the interface configuration, I can suggest you more specific configuration for it. Thanks, Varun Rao Security Team, Cisco TAC
... View more
11-20-2012
05:56 PM
Hi Chris, To test your failover you can put in any combination it does not put any load on your failover pair. It is a command to do a forcefu failover between firewalls and check the failover functionality. Thanks, Varun Rao Security Team, Cisco TAC
... View more
10-03-2012
11:27 AM
What is the platform you are using??? ASA, router?? Thanks, Varun Rao Security Team, Cisco TAC
... View more
09-28-2012
03:00 PM
If you add this nat, then all your DMZ should b able to access internet: nat (DMZ) 2 192.168.1.0 255.255.255.0 global (outside) 2 interface N also please remove the access-group: access-group internal out interface OUTSIDE It doesn't make sense to me. Thanks, Varun Rao Security Team, Cisco TAC
... View more
01-10-2013 05:34 PM
Hi,The nat that you are trying to do is only one to one nat, and it
cannot be one to many. You canno...
01-10-2013 07:18 AM
No Issues you can rate the post if it helped you.Thanks, Varun Rao
Security Team, Cisco TAC
01-10-2013 06:26 AM
No, you would not be able to access or ping the remote interface on the
ASA, you would only be able ...
01-10-2013 06:18 AM
Absolutely, the info above is in the case you are using failover(either
active/passive or active/act...
01-10-2013 06:17 AM
Which interface are you trying to access on the ASA from the remote lan
pool.Thanks, Varun Rao Secur...
01-10-2013 06:16 AM
Hi Hemant,How are you doing!!!!!A few reasons that I can see in here:1.
In the 8.2 nat exempt, it wa...
01-10-2013 06:06 AM
There is not much difference in terms of performance and approach, both
are correct and there is not...
01-10-2013 06:02 AM
Hi Nils,If you are using ASA version 8.3 or later you do not need the
same licenses on the two units...
01-10-2013 06:00 AM
If you are trying to access it over the VPN, can you add the command
"management-access inside' and ...
11-20-2012 05:56 PM
Hi Chris,To test your failover you can put in any combination it does
not put any load on your failo...
10-03-2012 11:27 AM
What is the platform you are using??? ASA, router??Thanks, Varun Rao
Security Team, Cisco TAC
Public Statistics
| Date Registered | 11-29-2010 01:11 AM |
| Date Last Visited | 08-18-2017 04:00 AM |
| Total Messages Posted | 2,230 |
| Total Helpful Votes Received | 1091 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 3 | |
| 40 | |
| 5 | |
| 5 | |
| 5 |
Helpful Votes From
