On the Cisco ASA firewalls with firmware version 8.3 or later the NAT commands have been changed and
you are basically required to add the NAT on an object and have to create an object for every tranlastion.
It reminds me how Checkpoint works. Although initially it looks more complicated, but I think it is more
efficient and gives you more flexibility. In short term, it is more object oriented.
Here are some samples which compares old versions and the new version commands.
Static NAT for a host
Pre-8.3 configuration:
static (inside,outside) 192.168.220.100 10.10.10.6 netmask 255.255.255.255
Post-8.3 configuration:
object network obj-10.10.10.6
host 10.10.10.6
nat (inside,outside) static 192.168.220.100
Static PAT for a host
Pre-8.3 configuration:
static (inside,outside) tcp 192.168.220.100 80 10.10.10.16 8080 netmask 255.255.255.255
Post-8.3 configuration:
object network obj-10.10.10.16
host 10.10.10.16
nat (inside,outside) static 192.168.220.100 service tcp 8080 www
Static Policy NAT
Pre-8.3 configuration:
access-list NET1 permit ip host 10.20.20.27 10.76.5.0 255.255.255.224
static (inside,outside) 192.168.220.100 access-list NET1
Post-8.3 configuration:
object network obj-10.20.20.27
host 10.20.20.27
object network obj-192.168.220.100
host 192.168.220.100
object network obj-10.76.5.0
subnet 10.76.5.0 255.255.255.224
nat (inside,outside) source static obj-10.20.20.27 obj-192.168.220.100 destination static obj-10.76.5.0 obj-10.76.5.0
Dynamic PAT
Pre-8.3 configuration:
nat (inside) 1 0 0
global (outside) 1 interface
Post-8.3 configuration:
object network obj_any
subnet 0.0.0.0 0.0.0.0
nat (inside,outside) dynamic interface
.
Pre-8.3 configuration:
nat (inside) 1 10.20.20.0 255.255.255.0
nat (dmz) 1 10.10.10.0 255.255.255.0
global (outside) 1 192.168.220.100
global (dmz) 1 192.168.10.1
Post-8.3 configuration:
object network obj-10.20.20.0
subnet 10.20.20.0 255.255.255.0
nat (inside,outside) dynamic 192.168.220.100
object network obj-10.20.20.0-01
subnet 10.20.20.0 255.255.255.0
nat (inside,dmz) dynamic 192.168.10.1
object network obj-10.10.10.0
subnet 10.10.10.0 255.255.255.0
nat (dmz,outside) dynamic 192.168.220.100
Dynamic Policy NAT
Pre-8.3 configuration:
object-group network og-net-src
network-object 192.168.10.0 255.255.255.0
network-object 192.168.20.0 255.255.255.0
object-group network og-net-dst
network-object 192.168.200.0 255.255.255.0
object-group service og-ser-src
service-object tcp gt 2000
service-object tcp eq 1500
access-list NET6 extended permit object-group og-ser-src object-group og-net-src object-group og-net-dst
nat (inside) 10 access-list NET6
global (outside) 10 192.168.220.100
.
Post-8.3 configuration:
object network obj-192.168.220.100
host 192.168.220.100
object service obj-tcp-range-2001-65535
service tcp destination range 2001 65535
object service obj-tcp-eq-1500
service tcp destination eq 1500
nat (inside,outside) source dynamic og-net-src obj-192.168.220.100 destination static og-net-dst og-net-dst service obj-tcp-range-2001-65535 obj-tcp-range-2001-65535
nat (inside,outside) source dynamic og-net-src obj-192.168.220.100 destination static og-net-dst og-net-dst service obj-tcp-eq-1500 obj-tcp-eq-1500a
Subscribe