Solved

conversion of nat from asa8.2 to asa8.3

Posted on 2011-03-22
6
946 Views
Last Modified: 2012-05-11
Exactly do they mean by twice NAT?

Also, what would be the PAT syntax and the NAT syntax for the network?

ex: How do I convert these commands?

global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 192.168.0.0 255.255.192.0
0
Comment
Question by:samashcam
  • 4
  • 2
6 Comments
 
LVL 11

Expert Comment

by:donmanrobb
ID: 35206239
object network LAN
 subnet 192.168.0.0 255.255.192.0
 nat (inside,outside) dynamic interface
0
 
LVL 11

Expert Comment

by:donmanrobb
ID: 35206253
Twice NAT allows you to NAT the source and destination at the same time.
Generally you would use it for no-nat scenarios
0
 

Author Comment

by:samashcam
ID: 35207692
So is that what I'm seeing with the ASDM? Every NAT rule has two statements.

Could that cause issues when you upgrade from 8.2 to 8.3? Nothing much was working right after the conversion.  We couldn't connect to a lot of the servers. What exactly should I be looking at as the culprit. NAT rules or access-rules? The access-rules look the same with ASDM in both 8.2 and 8.3 so I'm leaning towards NAT rules? Could the twice NAT cause issues?

I took out the unidirectional statements  for the VPNs.

0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 11

Accepted Solution

by:
donmanrobb earned 250 total points
ID: 35209794
Another thing to keep in mind is that ACL logic has changed in 8.3 as well.

The outbound access-list now matches the packet destination meaning that if you had a webserver with public IP of 1.2.3.4 and natted it to 192.168.1.10 then your acl should be

access-list <outside acl> permit tcp any host 192.168.1.10 eq 80 instead of
access-list <outside acl> permit tcp any host 1.2.3.4 eq 80

Hope that helps
0
 
LVL 11

Expert Comment

by:donmanrobb
ID: 35209927
Twice NAT can also cause issues because it is handled first in NAT order of operations.
0
 

Author Comment

by:samashcam
ID: 35210788
I found some access-lists that had the wrong ips.

thx!
0

Featured Post

What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article will cover setting up redundant ISPs for outbound connectivity on an ASA 5510 (although the same should work on the 5520s and up as well).  It’s important to note that this covers outbound connectivity only.  The ASA does not have built…
I found an issue or “bug” in the SonicOS platform (the firmware controlling SonicWALL security appliances) that has to do with renaming Default Service Objects, which then causes a portion of the system to become uncontrollable and unstable. BACK…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

785 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question