Solved

conversion of nat from asa8.2 to asa8.3

Posted on 2011-03-22
6
949 Views
Last Modified: 2012-05-11
Exactly do they mean by twice NAT?

Also, what would be the PAT syntax and the NAT syntax for the network?

ex: How do I convert these commands?

global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 192.168.0.0 255.255.192.0
0
Comment
Question by:samashcam
  • 4
  • 2
6 Comments
 
LVL 11

Expert Comment

by:donmanrobb
ID: 35206239
object network LAN
 subnet 192.168.0.0 255.255.192.0
 nat (inside,outside) dynamic interface
0
 
LVL 11

Expert Comment

by:donmanrobb
ID: 35206253
Twice NAT allows you to NAT the source and destination at the same time.
Generally you would use it for no-nat scenarios
0
 

Author Comment

by:samashcam
ID: 35207692
So is that what I'm seeing with the ASDM? Every NAT rule has two statements.

Could that cause issues when you upgrade from 8.2 to 8.3? Nothing much was working right after the conversion.  We couldn't connect to a lot of the servers. What exactly should I be looking at as the culprit. NAT rules or access-rules? The access-rules look the same with ASDM in both 8.2 and 8.3 so I'm leaning towards NAT rules? Could the twice NAT cause issues?

I took out the unidirectional statements  for the VPNs.

0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 11

Accepted Solution

by:
donmanrobb earned 250 total points
ID: 35209794
Another thing to keep in mind is that ACL logic has changed in 8.3 as well.

The outbound access-list now matches the packet destination meaning that if you had a webserver with public IP of 1.2.3.4 and natted it to 192.168.1.10 then your acl should be

access-list <outside acl> permit tcp any host 192.168.1.10 eq 80 instead of
access-list <outside acl> permit tcp any host 1.2.3.4 eq 80

Hope that helps
0
 
LVL 11

Expert Comment

by:donmanrobb
ID: 35209927
Twice NAT can also cause issues because it is handled first in NAT order of operations.
0
 

Author Comment

by:samashcam
ID: 35210788
I found some access-lists that had the wrong ips.

thx!
0

Featured Post

Free learning courses: Active Directory Deep Dive

Get a firm grasp on your IT environment when you learn Active Directory best practices with Veeam! Watch all, or choose any amount, of this three-part webinar series to improve your skills. From the basics to virtualization and backup, we got you covered.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you have an ASA5510 then this sort of thing would be better handled with a CSC Module, however on an ASA5505 thats not an option, and if you want to throw in a quick solution to stop your staff going to facebook during work time, then this is the…
This article assumes you have at least one Cisco ASA or PIX configured with working internet and a non-dynamic, public, address on the outside interface. If you need instructions on how to enable your device for internet, or basic configuration info…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…

821 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question