Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

conversion of nat from asa8.2 to asa8.3

Posted on 2011-03-22
6
Medium Priority
?
968 Views
Last Modified: 2012-05-11
Exactly do they mean by twice NAT?

Also, what would be the PAT syntax and the NAT syntax for the network?

ex: How do I convert these commands?

global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 192.168.0.0 255.255.192.0
0
Comment
Question by:samashcam
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2
6 Comments
 
LVL 11

Expert Comment

by:donmanrobb
ID: 35206239
object network LAN
 subnet 192.168.0.0 255.255.192.0
 nat (inside,outside) dynamic interface
0
 
LVL 11

Expert Comment

by:donmanrobb
ID: 35206253
Twice NAT allows you to NAT the source and destination at the same time.
Generally you would use it for no-nat scenarios
0
 

Author Comment

by:samashcam
ID: 35207692
So is that what I'm seeing with the ASDM? Every NAT rule has two statements.

Could that cause issues when you upgrade from 8.2 to 8.3? Nothing much was working right after the conversion.  We couldn't connect to a lot of the servers. What exactly should I be looking at as the culprit. NAT rules or access-rules? The access-rules look the same with ASDM in both 8.2 and 8.3 so I'm leaning towards NAT rules? Could the twice NAT cause issues?

I took out the unidirectional statements  for the VPNs.

0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 11

Accepted Solution

by:
donmanrobb earned 1000 total points
ID: 35209794
Another thing to keep in mind is that ACL logic has changed in 8.3 as well.

The outbound access-list now matches the packet destination meaning that if you had a webserver with public IP of 1.2.3.4 and natted it to 192.168.1.10 then your acl should be

access-list <outside acl> permit tcp any host 192.168.1.10 eq 80 instead of
access-list <outside acl> permit tcp any host 1.2.3.4 eq 80

Hope that helps
0
 
LVL 11

Expert Comment

by:donmanrobb
ID: 35209927
Twice NAT can also cause issues because it is handled first in NAT order of operations.
0
 

Author Comment

by:samashcam
ID: 35210788
I found some access-lists that had the wrong ips.

thx!
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

On Feb. 28, Amazon’s Simple Storage Service (S3) went down after an employee issued the wrong command during a debugging exercise. Among those affected were big names like Netflix, Spotify and Expedia.
Let’s face it: one of the reasons your organization chose a SaaS solution (whether Microsoft Dynamics 365, Netsuite or SAP) is that it is subscription-based. The upkeep is done. Or so you think.
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…
Suggested Courses

688 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question