Cisco Firewall :: Regular Dynamic PAT Statements In ASA 8.3?
Feb 19, 2012
have 2 inside networks:
object network INSIDE_10.6
subnet 10.6.0.0 255.255.0.0
object network INSIDE_192.168
subnet 192.168.0.0 255.255.255.0
I grouped these 2 into 1 object-group:
object-group network INSIDE
network-object object INSIDE_10.6
network-object object INSIDE_192.168
Public IP address used for PAT:
object network PAT
host 152.x.x.x
I used the following statement to create Dynamic PAT to public IP address:
object network INSIDE_10.6
nat (any,any) dynamic PAT
object network INSIDE_192.168
nat (any,any) dynamic PAT
Is that correct? Also I'm using one public address to PAT both inside networks. Is there any dvantage of using 2 different ones, so each inside network would be PAT to its own address?
View 1 Replies
ADVERTISEMENT
Jun 19, 2011
this is ASA5520 associate with 8.4(1). very simple scenario , three ports: inside . outside . DMZ my problem is how to use network object NAT to perform Regular Dynamic PAT and Identity NAT.
for example, this is my configuration
**** first i configured Regular Dynamic PAT****
object network myinside
subnet 10.200.11.0 255.255.255.0
nat (inside,outside) dynamic interface
**** then , i met problem when i want to make identity NAT between inside and DMZ****
**** if i add below CLI , the first nat line will be replaced ****
**** SO IF I ADD THIS****
[code]......
View 4 Replies
View Related
Aug 21, 2012
The configuration for the natting is something like this [code] If I understand the config statements 10.232.50.98 is natted to 32.x.x.66 and 10.232.50.99 is natted to 32.x.x.69 , but do we need reverse natting stements as well to work this ?
View 1 Replies
View Related
Jun 12, 2013
I would like to config "when host X on v lan X goes to a network that is across an ip sec tunnel, for which v lan X network is not in the encryption domains, translate host X address to that of the asa in a network that is part of the crypto domain".
Interface vlan544 (172.16.80.0/24) is the local encryption domain, and 10.1.0.0/29 holds some monitoring servers that should not be part of the encryption domain, but rather get it's source address translated to that of the firewall in 172.16.80.0/24. Here's how I did:
# Vlan522 for 10.1.0.0/29, need to somehow have a specific nat here I guess that falls between the no nat and the generic "nat the rest to the global)
[code]...
This obviously didn't work, the second (number 2) rule is never hit. What am I doing wrong?
View 2 Replies
View Related
Oct 3, 2012
I have a Cisco ASA running 8.2 in routed mode.The ASA has three interfaces, inside, outside and DMZ. They connect to the following three networks:
Inside: 10.1.1.0/24
Outside: 10.1.2.0/24
DMZ: 100.1.1.0/24
I have the following dynamic PAT configuration:
nat (inside) 1 10.1.1.0 255.255.255.0
global (outside) 100.1.1.1
nat control is turned off.
By my understanding any traffic from the inside to outside interface will be PATted to 100.1.1.1. However, communications between inside and the DMZ will not be PATted, and should work with no problems.This seems to be corroborated by this document: [URL]Which states:"The adaptive security appliance translates an address when a NAT rule matches the traffic. If no NAT rule matches, processing for the packet continues."EDIT: I may have misunderstood the above statement.I found this guide to configuring NAT/PAT: [URL]It states:"When you specify a group of IP address(es) in a nat command, then you must perform NAT on that group of addresses when they access any lower or same security level interface; you must apply a global command with the same NAT ID on each interface, or use a static command. NAT is not required for that group when it accesses a higher security interface because to perform NAT from outside to inside you must create a separate nat command using the outside keyword. If you do apply outside NAT, then the NAT requirements preceding come into effect for that group of addresses when they access all higher security interfaces. Traffic identified by a static command is not affected."My problem is that packet tracer does not seem to bear me out. It tells me the packet is dropped due to "no matching global" when I source traffic from the inside interface and send it to the DMZ.
View 3 Replies
View Related
Sep 10, 2012
Is there a cisco best practice on the maximum number of NAT statements on a Cisco ASA? We have a 5520 and a coworker is adding static NAT policies so a vendor can monitor around 1,029 nodes. The problem is each node inside is a 10.X.X.X and to keep the IPs from overlapping with other customers the vendor monitors they would like us to NAT to a 172.16.X.X scheme.
View 3 Replies
View Related
Oct 16, 2011
I have a asa 5520 with an outside and backup interface. I am trying to configure two static nat statements from the inside to the outside and backup interface. Here is what I have configured so far.
object network obj-10.1.1.254
host 10.1.1.254
object network obj-10.1.1.254
nat (inside,outside) static 172.25.10.3
I want to also use nat (inside,backup) static 172.25.10.3
View 3 Replies
View Related
Feb 14, 2012
I am configuring a pix 525,i just found out how to activate the subinterface on it so that's good,the box has a primary unit and secondary unit, both are connected from G0 to redundant switches,if i do a show failover, it says it's using the serial based lan failover, which is fine by me,however, do i need to create a single, regular interface.. or a redundant interface?,i.e. if i create a regular subinterface, will failover still apply to this interface?,or for failover to work, do i need to create a redundant interface (with a redundant id)? i do not seem to have the option to create a subinterface when adding a redundant interface.
View 7 Replies
View Related
Oct 16, 2011
i have a Cisco ASA 5520 8.4(1) with a ASA 5520 VPN Plus license
i want to use the management interface as a regular interface (using the no management-only command)is this interface a Gig interface as well ?
View 1 Replies
View Related
Oct 2, 2012
I have a ASA 5510, it does webfilter using regular expression. [URL]
I block ".facebook.com" and it was successfull. But somehow other users is using https to access to FB. how do i filter HTTPS?
View 5 Replies
View Related
Dec 4, 2012
I am having an issue with a specific server that is not reachable from other sub nets. Every other device on the same sub net as the server is reachable via the other sub nets. This server is special because it's NAT'd to an external IP address and has several site-to-site VPN's set up. The firewall is a Cisco ASA 5510.
This is the error I see on the ASA syslog when I try to ping the server from another sub net: 3 Dec 05 2012 10:58:49 10.0.15.101 regular translation creation failed for icmp src inside:10.0.20.8 dst inside:10.0.15.101 (type 0, code 0)
The problem server is on sub net 10.0.20.0/24 and the server IP address is 10.0.20.8. Every device on the 10.0.20.0/24 sub net can hit the server, but devices on other sub nets cannot. For instance, a device on 10.0.15.0/24 cannot reach 10.0.20.8, but can reach other devices on 10.0.20.0/24.
View 1 Replies
View Related
Apr 2, 2012
I've recently switched to an ASA 5510 on 8.4(3) coming from a Checkpoint NGX platform (let's say fairly quickly and without much warning ). I have a couple questions and they're kind of similar so I'll post them up. I've read docs about regex and creating them both via command line and ASDM, but the examples always seem to include info I don't need or honestly something I don't understand yet (mainly related to defining classinspect maps). If someone could provide a simple example of how to do these in ASDM that would be useful in understanding how regular expressions are properly configured. So here we go.
I know this is basic but I need to make sure I understand this properly - I have a single web server (so this won't be a global policy) where I need to allow access to a specific URL pathfile and that's it. So we'll call it est estfile.doc. Any other access to any other path should be dropped. What's the best way to do this in ASDM (6.4)? I think if I saw a basic example for this I could figure out next few questions but I'll post them as well just in case.
I have another single public web server (again this won't be a global policy) where I'd like to specify blocking file types, like .php, .exe., etc... again a basic example would be great.
Lastly, and this is kind of related, but we have a single office/domain and sometimes we get spam from forged addresses appearing to be from our domain. On Checkpoint I used to use its built-in SMTP security server and could define if it received mail from *@mydomain.com to drop it because we would never receive mail externally from our own domain name. I saw something similar with ESMTP in ASDM and it looks kind of like how you set up the URL access mentioned above. Can I configure this in ASDM as well, and if so how?
View 1 Replies
View Related
Jan 31, 2011
i have cisco asa 5510 as firewall, i was trying to block some site using the link provided below
[URL]
and its working fine, but the problem i am having, when i go to download attachment from hotmail its not downloading, from gmail and other mails its
View 13 Replies
View Related
Oct 10, 2011
We have a PIX with 3 interfaces. Inside, Outside,DMZ.
On my DMZ we have some clients that come in and remotely connect back to there office via MSPPTP. I setup the ASA with this to get rid of the error message: regular translation creation failed for protocol 47 src
policy-map global-policy
inspection_default
inspect pptp
Now when the dmz client tries to connect back to there PPTP server I get the following error.
172.31.10.204 0 24.172.85.162 37624 Teardown dynamic GRE translation from dmz:172.31.10.204/0 to outside:24.172.85.162/37624 duration 0:01:30
172.31.10.204 1069 173.188.74.155 1723 Deny TCP (no connection) from 172.31.10.204/1069 to 173.188.74.155/1723 flags PSH ACK on interface dmz
172.31.10.204 173.188.74.155 63767 Teardown GRE connection 8393958 from dmz:172.31.10.204 to outside:173.188.74.155/63767 duration 0:01:08 bytes [ code]...
View 7 Replies
View Related
Oct 20, 2012
i use ASA 5510 and i want to block some urls :
-192.168.2.70 to 79 allow every thing
-192.168.2.80 to 89 : block facebook , myspace, twiter,
-192.168.2.90 to 99 : block facebook , myspace, twiter, youtube , dailymotion
-192.168.2.100 to 199 deny everting
View 1 Replies
View Related
Dec 27, 2011
We have an ASA 5505 and I want to block www.facebook.com for all users on the inside network. I followed the instructions laid out in Cisco support document ID 100513 using regular expressions with MPF but am running into some problems.
[URL]
Once the configuration has been changed based on these instruction www.facebook.com is blocked. However I can't access any other websites except my Google News home page comes up just fine for some reason.
ASA Version 7.2(3)
!
hostname ciscoasa
domain-name default.domain.invalid
enable password 4nJloDG8uYd8w4D3 encrypted
names
!
interface Vlan1
[code]....
View 18 Replies
View Related
May 27, 2012
The config is from our MPLS router located in HeadOffice, ^controlled-ospf ^ whats its function^ routes_in ^ whats its functionhow to change standard acl to extended acl.
View 5 Replies
View Related
Jan 25, 2012
As long as I have been doing this stuff, I have never had a clear understanding of all of the 6500 boot images and statements. The more I read online, the more I get confused.
1. What is the boot image "boot-mz" for? Where should it be placed (i.e. bootflash)? what command do I need to issue in order to use the boot image I want?
2. What is the IOS rommon image for? I thought the rommon image was the boot image but apparently these are two different images. Where should it be placed (i.e. bootflash, sup-bootflash, etc). What command do I use to ensure that I am using this IOS rommon image?
View 3 Replies
View Related
Feb 7, 2012
I can't figure out why the ASA cannot send traffic to the internet with the below config. What did I do wrong?
View 3 Replies
View Related
Feb 16, 2012
I can't figure out why the ASA cannot send traffic to the internet with the below config. What did I do wrong?
interface Ethernet0/0
nameif Outside
security-level 0
ip address 4.28.x.x 255.255.255.252
!
interface Ethernet0/3
[Code]...
View 12 Replies
View Related
Feb 24, 2013
its possible to have same dynamic translation within 2 different networks like:
interface gig 0/1
1.1.1.1 255.255.255.0 (LAN Connection w/ DHCP enabled)
inteface gig 0/2
2.2.2.1 255.255.255.0 (Wireless Connection w/ DHCP enabled)
Actually, the scenario was 1.1.1.1 is my LAN connection and 2.2.2.1 are my Wireless connection.
View 3 Replies
View Related
Oct 5, 2011
I need to create a vpn tunnel between my Cisco 837 having a dynamic IP and my Firewall (Static IP).
View 1 Replies
View Related
Apr 11, 2011
I have devices on Inside interface of ASA that need to get to Internet to get ntp. Hence I want to set up dynamic pat (interface overload) which 8.3 style would be
-object network obj_NTP-DEV
-host 192.168.1.250
-nat (INSIDE,INTERNET) dynamic interface
But I need to limit nat to only Internet destined traffic on ntp port not all ports for traffic from 192.168.1.250.I'm not using this nat set up to control outbound access - I also have incoming RA VPN tunnels to the box and traffic from these sources need to be able to get to 192.168.1.250 and the above simple set up would break that access as all traffic involving 192.168.1.250 would get nat'd
Reading the doco I've sent myself round in a loops trying to figure how you are meant to do such a " Dynamic Policy NAT (overload)" call it what you will config in 8.3
View 2 Replies
View Related
Oct 10, 2011
I am trying to set a logging discriminator that will drom any message contans the mnemonics etc. "ABC" and "XYZ". As fists step I configure this:logging discriminator nolog mnemonics drops ABC
but when I am trying to add a second statement.logging discriminator nolog mnemonics drops XYZ
in the same discriminator (nolog) it replaces the first statement with the last. So in the show run I have always one statement for discriminator "nolog". Finally, how can I configure a logging discriminator with more than one statement? I am using IOS Version 12.2(33)SRD4 on a Cisco 7609.
View 5 Replies
View Related
Mar 23, 2013
Recently we migrated our network to ASA 5515, since we had configured nat pool overload on our existing router the users are able to translated their ip's outside. Right now my issue was when I use the existing NAT configured to our router into firewall, it seems that the translation was not successful actually I used Dynamic NAT. When I use the Dynamic PAT(Hide) all users are able to translated to the said public IP's. I know that PAT is Port address translation but when I use static nat for specific server. The Static NAT was not able to translated. Any conflict whit PAT to Static NAT?
View 3 Replies
View Related
Nov 8, 2011
in ASA 8.4, I need to use to static nat an internal IP with a public IP and use the same public IP to dynamic nat another internal IP:
-nat (inside,outside) source static IP1_PRIVATE IP_PUBLIC
-nat (inside,outside) source dynamic IP2_PRIVATE IP_PUBLIC
All outgoing connection from IP1_PRIVATE and IP2_PRIVATE should be natted to IP_PUBLIC and all incoming connection to IP_PUBLIC should be forwarded to IP1_PRIVATE: is it correct ?
View 3 Replies
View Related
Jun 3, 2012
I have a site with an ASA5505 and 2 isp connections but the catch is the 2 isp's are giving me a dynamic IP so I am unable to use this [URL]
View 3 Replies
View Related
Jan 10, 2012
Does ASA 5540 support BGP routing protocol to be configured on it??
I'm talking about the latest versions.
View 3 Replies
View Related
Oct 5, 2011
we are running 8.4(2) on the asa with the below configuration we basically have a static for .7 on .25 and a nat for .7 for port direction with manual nat that takes precedense over auto nat within the object group am I correct that I dontneed the dynamic statement and that its redundant?
-object network obj-10.X.0.25-02host 10.X.0.25
-object network obj-10.X.0.25nat (any,INSIDE) static X.X.X.7 dns
-object network obj-10.X.0.25-01nat (INSIDE,OUTSIDE) static X.X.X.7 service tcp smtp smtp
-object network obj-10.X.0.25-02nat (INSIDE,OUTSIDE) dynamic X.X.X.7
View 1 Replies
View Related
Jan 13, 2013
To configure a dynamic NAT, PAT, or identity NAT rule, I need to perform the following steps:
Step 1 From the Configuration > Firewall > NAT Rules pane, choose Add > Add Dynamic NAT Rule.
The Add Dynamic NAT Rule dialog box appears. However, when I click on Add I don't get the option to Add Dynamic Nat Rule. To see the options I get please see attachment.
The following is a capture of the show version:
ciscoasa# show ver Cisco Adaptive Security Appliance Software Version 8.4(2) <system> Device Manager Version 6.4(1) Compiled on Wed 15-Jun-11 18:17 by builders System image file is "Unknown, monitor mode tftp booted image" Config file at boot was "start up-config"
ciscoasa up 16 mins 57 secs Hardware: ASA 5520, 1024 MB RAM, CPU Pentium II 1000 MHz Internal ATA Compact Flash, 256MB
BIOS Flash unknown @ 0x0, 0KB
0: Ext: GigabitEthernet0 : address is 00ab.a72f.0100, irq 0
1: Ext: GigabitEthernet1 : address is 00ab.a72f.0101, irq 0
2: Ext: GigabitEthernet2 : address is 0000.ab6d.9802, irq 0
[code]...
This platform has an ASA 5520 VPN Plus license. Serial Number: 123456789AB
Running Permanent Activation Key: 0x4a3ec071 0x0d86fbf6 0x7cb1bc48 0x8b48b8b0 0xf317c0b5
Configuration register is 0x0
Configuration has not been modified since last system restart.
View 8 Replies
View Related
Jan 29, 2012
I have a 6509 running s72033_rp-ADVIPSERVICESK9_WAN-M version 12.2(33)SXH5. Four incorrect bgp aggregate-address statements were entered in which overlap. Attempted to remove the statements but they won't come out.
aggregate address 16.37.31.0 255.255.224.0 summary-only
aggregate address 16.37.30.0 255.255.224.0 summary-only
aggregate address 16.37.29.0 255.255.224.0 summary-only
aggregate address 16.37.26.0 255.255.224.0 summary only
I have entered in the correct statements and have no problem getting those in, removing them, and reentering them.
View 2 Replies
View Related
Jun 1, 2011
I have ASA 5510 and public FTP server from my local network to external IP address, with static nat translation. All works, but I need request to ftp come from internal ASA interface (need use gateway different ASA). How configured ASA for forwarding request?
View 4 Replies
View Related
Feb 18, 2013
How to get DynDNS or some other public dynamic DNS services on the Internet working on ASA 5505?
View 2 Replies
View Related
