ASA5510 to ASA 5512 upgrade - NAT help

I"m trying to upgrade an ASA 5510 to an ASA 5512 and I'm struggling with the new NAT commands.  I'm creating objects and when I apply them and look in running config it doesn't have all of my entries.

For example, I input this into the asa5512:

object service 9000_Ports
service tcp source range 9000 9002
service tcp source range 9100 9110
service udp source range 9000 9002
service udp source range 9100 9110
nat (inside,outside) source static 192_168_0_5 12_189_4_179 service 9000_Ports 9000_Ports

object service MATRIX
service tcp source range 41780 41795
service tcp source eq 80
service tcp source eq 8081
nat (inside,outside) source static 192_168_0_197 12_189_4_182 service MATRIX MATRIX



And it shows up in the config as:


object service 9000_Ports
 service udp source range 9100 9110
object service MATRIX
 service tcp source eq 8081
nat (inside,outside) source static 192_168_0_5 12_189_4_179 service 9000_Ports 9000_Ports
nat (inside,outside) source static 192_168_0_197 204_xxx_xx_182 service MATRIX MATRIX


I've attached the ASA5510 config in hopes someone can offer some guidance as to what I'm doing wrong.
ASA5510.txt
ASA5512.txt
LVL 4
jplagensAsked:
Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

x
 
Ernie BeekExpertCommented:
I think you need object-group service for that:

configure mode commands/options:
  icmp-type  Specifies a group of ICMP types, such as echo
  network    Specifies a group of host or subnet IP addresses
  protocol   Specifies a group of protocols, such as TCP, etc
  service    Specifies a group of TCP/UDP ports/services


Also, did you find this: http://www.cisco.com/en/US/docs/security/asa/asa83/upgrading/migrating.html
It's a nice guide for migrating.
0
 
jplagensAuthor Commented:
Thanks.  I was able to get the object-groups in:

object-group service 9000PORTS
 service-object tcp source range 9000 9002
 service-object tcp source range 9100 9110
 service-object udp source range 9000 9002
 service-object udp source range 9100 9110
object-group service MATRIX
 service-object tcp source range 41780 41795
 service-object tcp source eq www
 service-object tcp source eq 8081

Having an issue with the NAT command.  It's telling me:

ERROR: 9000PORTS is not a valid service object name
ERROR: MATRIX is not a valid service object name


This the NAt command I'm trying:

nat (inside,outside) source static 192_168_0_5 204_xxx_xx_179 service 9000PORTS 9000PORTS

nat (inside,outside) source static 192_168_0_197 204_xxx_xx_182 service MATRIX MATRIX
0
 
jplagensAuthor Commented:
After reading through the Cisco website I've come up with this:

nat (inside,outside) source dynamic 9000PORTS interface
nat (inside,outside) source dynamic MATRIX interface

Will this work?
0
All Courses

From novice to tech pro — start learning today.