Solved

conversion of nat from asa8.2 to asa8.3

Posted on 2011-03-22
6
933 Views
Last Modified: 2012-05-11
Exactly do they mean by twice NAT?

Also, what would be the PAT syntax and the NAT syntax for the network?

ex: How do I convert these commands?

global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 192.168.0.0 255.255.192.0
0
Comment
Question by:samashcam
  • 4
  • 2
6 Comments
 
LVL 11

Expert Comment

by:donmanrobb
Comment Utility
object network LAN
 subnet 192.168.0.0 255.255.192.0
 nat (inside,outside) dynamic interface
0
 
LVL 11

Expert Comment

by:donmanrobb
Comment Utility
Twice NAT allows you to NAT the source and destination at the same time.
Generally you would use it for no-nat scenarios
0
 

Author Comment

by:samashcam
Comment Utility
So is that what I'm seeing with the ASDM? Every NAT rule has two statements.

Could that cause issues when you upgrade from 8.2 to 8.3? Nothing much was working right after the conversion.  We couldn't connect to a lot of the servers. What exactly should I be looking at as the culprit. NAT rules or access-rules? The access-rules look the same with ASDM in both 8.2 and 8.3 so I'm leaning towards NAT rules? Could the twice NAT cause issues?

I took out the unidirectional statements  for the VPNs.

0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 
LVL 11

Accepted Solution

by:
donmanrobb earned 250 total points
Comment Utility
Another thing to keep in mind is that ACL logic has changed in 8.3 as well.

The outbound access-list now matches the packet destination meaning that if you had a webserver with public IP of 1.2.3.4 and natted it to 192.168.1.10 then your acl should be

access-list <outside acl> permit tcp any host 192.168.1.10 eq 80 instead of
access-list <outside acl> permit tcp any host 1.2.3.4 eq 80

Hope that helps
0
 
LVL 11

Expert Comment

by:donmanrobb
Comment Utility
Twice NAT can also cause issues because it is handled first in NAT order of operations.
0
 

Author Comment

by:samashcam
Comment Utility
I found some access-lists that had the wrong ips.

thx!
0

Featured Post

Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

Join & Write a Comment

Overview The Cisco PIX 501, PIX 506e, ASA 5505 and ASA 5510 (most if not all of this information will be relevant to the PIX 515e but I do not have a working configuration handy to verify the validity) are primarily used within small to medium busi…
I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…
Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now