Solved

ASA5510 to ASA 5512 upgrade - NAT help

Posted on 2013-02-04
4
1,605 Views
Last Modified: 2013-03-14
I"m trying to upgrade an ASA 5510 to an ASA 5512 and I'm struggling with the new NAT commands.  I'm creating objects and when I apply them and look in running config it doesn't have all of my entries.

For example, I input this into the asa5512:

object service 9000_Ports
service tcp source range 9000 9002
service tcp source range 9100 9110
service udp source range 9000 9002
service udp source range 9100 9110
nat (inside,outside) source static 192_168_0_5 12_189_4_179 service 9000_Ports 9000_Ports

object service MATRIX
service tcp source range 41780 41795
service tcp source eq 80
service tcp source eq 8081
nat (inside,outside) source static 192_168_0_197 12_189_4_182 service MATRIX MATRIX



And it shows up in the config as:


object service 9000_Ports
 service udp source range 9100 9110
object service MATRIX
 service tcp source eq 8081
nat (inside,outside) source static 192_168_0_5 12_189_4_179 service 9000_Ports 9000_Ports
nat (inside,outside) source static 192_168_0_197 204_xxx_xx_182 service MATRIX MATRIX


I've attached the ASA5510 config in hopes someone can offer some guidance as to what I'm doing wrong.
ASA5510.txt
ASA5512.txt
0
Comment
Question by:jplagens
  • 2
  • 2
4 Comments
 
LVL 35

Expert Comment

by:Ernie Beek
ID: 38851221
I think you need object-group service for that:

configure mode commands/options:
  icmp-type  Specifies a group of ICMP types, such as echo
  network    Specifies a group of host or subnet IP addresses
  protocol   Specifies a group of protocols, such as TCP, etc
  service    Specifies a group of TCP/UDP ports/services


Also, did you find this: http://www.cisco.com/en/US/docs/security/asa/asa83/upgrading/migrating.html
It's a nice guide for migrating.
0
 
LVL 35

Accepted Solution

by:
Ernie Beek earned 500 total points
ID: 38851235
0
 
LVL 4

Author Comment

by:jplagens
ID: 38851389
Thanks.  I was able to get the object-groups in:

object-group service 9000PORTS
 service-object tcp source range 9000 9002
 service-object tcp source range 9100 9110
 service-object udp source range 9000 9002
 service-object udp source range 9100 9110
object-group service MATRIX
 service-object tcp source range 41780 41795
 service-object tcp source eq www
 service-object tcp source eq 8081

Having an issue with the NAT command.  It's telling me:

ERROR: 9000PORTS is not a valid service object name
ERROR: MATRIX is not a valid service object name


This the NAt command I'm trying:

nat (inside,outside) source static 192_168_0_5 204_xxx_xx_179 service 9000PORTS 9000PORTS

nat (inside,outside) source static 192_168_0_197 204_xxx_xx_182 service MATRIX MATRIX
0
 
LVL 4

Author Comment

by:jplagens
ID: 38851650
After reading through the Cisco website I've come up with this:

nat (inside,outside) source dynamic 9000PORTS interface
nat (inside,outside) source dynamic MATRIX interface

Will this work?
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Quality of Service (QoS) options are nearly endless when it comes to networks today. This article is merely one example of how it can be handled in a hub-n-spoke design using a 3-tier configuration.
This past year has been one of great growth and performance for OnPage. We have added many features and integrations to the product, making 2016 an awesome year. We see these steps forward as the basis for future growth.
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…

860 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question