Auto nat vs manual nat

Some how I have ended up with multiple network objects for the same network example
obj-192.168.1.0
obj-192.168.1.0-1
obj-192.168.1.0-2
All are for the same network but have different nat statements. When I look at my NAT statements I have a bunch of manual NAT and Network object NAT rules. I'm pretty confussed on the two. Should I just have one auto nat statement for each object? Then if I need another NAT statement for the same network make it a manual nat?

Would I be correct to presume you have updated/upgraded the ASA software from pre 8.3 to post 8.3 by letting the ASA convert the configuration by itself and not actual write the configurations yourself?
If that is true then it would seem to me that these configurations might be the 8.3 (and later) softwares way of doing Identity NAT between your local ASA interfaces. (Which can also be done with Twice NAT / Manual NAT)
I would for example guess that the following configuration
object network obj-172.16.0.0-05
subnet 172.16.0.0 255.254.0.0
nat (inside,TM) static 172.16.0.0
Before was this
static (inside,TM) 172.16.0.0 172.16.0.0 netmask 255.254.0.0
In the new software 8.3+ if you have local LAN and DMZ interfaces on the ASA which dont require NAT between them, you can simply leave out the NAT configurations. So if your purpose is to enable communication between local interfaces wihtout modifying the source or destination address then I would leave out all those NAT configurations.
In the very basic setups you only really need to perform NAT between the local and public interfaces. The new ASA software doesnt have any "nat-control" anymore. If there is no NAT rule for the traffic incoming to the ASA then the ASA will simply pass it along without NAT.
- Jouni

Similar Messages

Moving Manual NAT to section 3 (after auto nat)

Hi All,
We have 3 sections of NAT
1>Manual NAT
2>Auto NAT
3>Manual NAt after Auto.
Lets say on ASA we config Manual and Auto Nat.
Now Order of NAT is
1>Manual
2>Auto
If i move the Manual NAT to section 3 of NAT which is Manual NAT after auto NAT.
Now Order of NAT is
2>Auto
3>Manual NAT after Auto.
Now when i try to do Process Manual NATafter auto section number 3 it does not work as it hits Auto NAt and does not go down.
Need to know the reason behind this?
Regards
MAhesh

Also as a little side note,
There is also difference in the ordering of the NAT configurations depending on the Section
Section 1 and Section 3 Manual NAT rules are always gone through in the order you see them in the actual CLI configuration. So you might have 2 completely working rules BUT if they are in the wrong order it might be that other one of them is never used
Section 2 Auto NAT rules are processed in an order that you dont usually decide yourself. The ASA puts them in order according to how they were configured.
So in a nutshell. You can manually set the order of the Manual NAT rules but Auto NAT rules are ordered automatically by the ASA itself.
You can see the current order of the Auto NAT rules with the command
show nat
- Jouni

Manual Nat (twice Nat) Answers

There seems to be a large number of the subject queries in one form or another. Having acquired an asa 5505 and using 8.43 firmware and the ADSM gui for router configuration it has not been an easy transition from other products.   I have come to understand embedded NAT objects for basic port forwarding but am at a loss on configuring twice nat or manual nat, not really ever dealing with it before, or in this manner.
What I would like to suggest to the experts and to those with the ability to give advice to document editers is to include far more ADSM web gui examples and discussion for manual nat.   The tools are all there - in the nat rules editing page, the display of the rules pictorially and the packet flow at the bottom of the page (and finally thru packet tracing).   What is needed is more on the actual entries on the nat editing pages and the logic and explanation of those entries.   In this forum what I would like to see is when there are responses that they include both the CLI recommended entries b AND the associated adsm web gui pics. With good documents for reading and examples in the forum, I think there should be much less confusion allowing more attention to some very complex scenarios.   I personally feel a bit embarrassed to be asking basic questions and appreciate the responses but with improvements in docs and forum answers the number of such questions should drop. At the very least I and others like me will get better edumecated.    To be clear am not looking for the easy cookie cutter right answers, I am looking to understand CIsco packet routing through explanations of the web gui entries. In fact, I am learning far more by trying to understand the web gui vice simply copying and entering CLI commands. In terms of documents, for example, there should be a very thorough explanation of the relationship between "Translated Addr:" in the first NAT editing page with "Destination Inteface" in the second Advanced page .
Thanks.
Examples below of what I am talking about (note examples are simple embedded NAT object (port forwarding rules). I can finally handle external users requiring access to internal servers. :-) But that is just the surface.
I have added the packet tracing jpegs for further context. There is an UNNAT lookup entry (first trace block, out of view on the pic) a concept which is missing in the documentation I've read that needs to be added but it is illuminating in how the router handles traffic.   What is also interesting is the fourth jpeg which also shows the flow designation of a packet and its handling internally (new packet or one that is associated with an existing packet (previously identified and put in an appropriate table xlate etc)).

Hi,
I've personally always preferred using CLI over GUI. Probably comes due to the fact I started with old Cisco switches and routers.
When I first used a Cisco PIX the switch from switches/routers was a bit hard. The configuration format in 6.x was totally different from the IOS. After I upgraded the first PIX to software 7.0 it was abit more familiar already. Interfaces were now configured like in the switches and routers. Also the permitting traffic through the device used access-lists.
I was just beginning to handle all the different NAT setups (atleast the ones we run into) and then came 8.3 (and 8.4) which totally changed the NAT configuration format
I still find myself configuring the NAT through CLI. I use the CLI because I like beeing able to see the whole device configuration without jumping from tab to tab and clicking drop down menus. I mostly use ASDM to edit existing configurations or something that might not be as familiar with. Though my goal usually is to learn to configure the same from the CLI after I've done it a couple of times from GUI interface.
If you're only using ASDM GUI to configure the ASA, I suggest you go "Tools -> Preferences" and from there enable the option "Preview commands before sending them to the device" This will basicly show you all configurations that you are going to apply in the CLI format. I think this preview setting is off by default.
EDIT2: One really helpfull thing is also the fact that you can get help for almost every configuration page on the ASDM GUI. I think theres almost always a direct "Help" button that opens information about the configuration page in question and clarifies all the options you have on the page. Again, as I haven't used much ASDM, I dont know if they clarify the things you are asking for.
The first 2 pictures to my understanding illustrate the configuration of a port forwarding using the "outside" interfaces address.
The first pictures Translated Address just refers that you are going to use the "outside" interfaces IP address (whatever it might be) to configure a NAT. The ASDM has a habit of giving names to IP addresses which can confuse you. The same line might as well contain an IP address in numeric format if you for example had a small public subnet at your disposal for NAT translations.
The second pictures source/destination interface just basically tells you the interfaces between which the NAT is beeing performed. Either of these can also be specified as "any".
I'll give you a couple of examples
EXAMPLE 1
The below configuration basicly tells the ASA that it will PAT all outbound (outside) traffic from the source networks defined in the object-group to the outside interface address. It also tells that the source interface can be any interface on the ASA.
So basically if you keep adding interfaces to an ASA that need (Or networks behind them) default PAT translations when they use the Internet, you can just keep adding "network-object x.x.x.x y.y.y.y" statements with the new networks under the object-group and the ASA will do PAT for them. You wont have to configure any additional NAT statements.
object-group network DEFAULT-PAT-SOURCE-NETWORKS
description Source Networks for PAT
network-object 10.10.10.0 255.255.255.0
network-object 192.168.0.0 255.255.255.0
network-object 172.16.8.0 255.255.255.0
nat (any,outside) after-auto source dynamic DEFAULT-PAT-SOURCE-NETWORKS interface
EXAMPLE 2
The below configuration basically tells the ASA that the DMZ server will be visible to other hosts behind other ASA interface with the same NAT ip of "1.2.3.4". This could apply to situations where you want to access the DMZ server with the same public IP address from both the Internet and the LAN.
This could help with situations where your LAN uses public DNS and that DNS points to the servers public IP address. With this NAT configuration even though you LAN hosts are connecting to a public IP address the device will still be accessible from the LAN since you're NATing the DMZ server towards all interfaces.
object-network DMZ-PUBLIC-STATIC
description Static Public IP for DMZ server
host 192.168.10.10
nat (dmz,any) static 1.2.3.4 dns
The UN-NAT section to my understanding just tells you that a connection coming from outside to a NAT IP is basically forwarded to the actual lan host IP address and not the public IP the user was originally connecting to.
To be honest I don't really know how to configure well with the ASDM as I usually just use the CLI. Because of that I'm sometimes at a loss on how to configure the most simple things because I've only done them on the CLI.
Hope some of this was helpfull to you
EDIT: Didn't realize I wrote so much
- Jouni

Identifying Manual NAT in ASDM

Hi Everyone,
Below is the screenshot from Cisco LEarning Website for ASA Practice test.
Correct answer is Manual NAT polices .
Need to know what should i look for in ASDM that will tell me it is Manual NAT?
Regards
MAhesh
Message was edited by: mahesh parmar

It is manual because the screenshot shows that there are no Network Object NAT rules. So the displayed NAT rule is of type #3 in the list below.
In ASA 8.3 or later there are 3 types of NAT rules you can add:
1. Manual NAT before Network-object NAT
2. Network-Object NAT (network-object NAT is also known as AutoNAT)
3. Manual NAT after Network-object NAT.
If you looked at the cli, it would have the keyword "after-auto" in the NAT rule.

Example of Manual NAT to implement NAT exemption

Hi Everyone,
Below is from Cisco LEarning Network site
Referring to the Cisco ASA NAT configuration below
object network one
subnet 10.1.1.0 255.255.255.0
object network two
subnet 192.168.1.0 255.255.255.0
nat (inside,outside) source static one one destination static two two
Need to understand how below answer is correct?
This is an example of Cisco ASA 8.3 manual NAT to implement NAT exemption.
Regards
MAhesh

Hi Mahesh,
Yes, the above configuration achieves a NAT0 type configuration in the new 8.3+ ASA softwares.
In the 8.2 and older softwares we used an ACL to tell the ASA between which networks there should be no translation to the source address.
The above configuration could correspond to the following on the 8.2 software
access-list INSIDE-NAT0 permit ip 10.1.1.0 255.255.255.0 192.168.1.0 255.255.255.0
nat (inside) 0 access-list INSIDE-NAT0
And as you have already mentioned the 8.3+ format is
object network one
subnet 10.1.1.0 255.255.255.0
object network two
subnet 192.168.1.0 255.255.255.0
nat (inside,outside) source static one one destination static two two
In the new format you see the same things as you saw in the older format using ACL. It tells between which interfaces this NAT applies. It also tells between which source and destination networks this applies.
Now lets look at the above "nat" statement in all of its parts
nat = Is the actual command which starts the NAT configuration whatever NAT you were configuring
inside = Is the source interface for the NAT as its mentioned first
outside = Is the destination interface for the NAT its mentioned second
source = Simply specifies that the source parameters for this NAT configuration will follow
static = Defines that were doing a Static type of NAT
one = Defines the real source network
one = Defines the mapped source network
destination = Simply specifies that the destination parameters for this NAT configuration will follow
static = Defines that the destination is static. It can only be static
two = Defines the mapped destination network
two = Defines the real destination network
And the key things to notice from the configuration.
Both source and destination real and mapped networks are the same. This means that the source network and destination network should stay unchanged. So in essence we are doing NAT0.
When we add the "destination static " this automatically means that the NAT will only be applied when the destination of the traffic is this network. This naturally applies in the reverse direction since the rule is bidirectional.
I am not really sure if I explained the above in the best way I could. Hope it makes any sense
- Jouni

ASA 8.2 - Static NAT and Dynamic NAT Policy together

Hello community,
I have the following problem using a ASA with version 8.2.
1) I have this segment on interface Ethernet 0/0: 192.168.1.0/24
2) Through interface Ethernet 0/1 I will reach several servers using the same source IP, but other servers must be reached using only one IP, for example 192.168.1.70
so, I have configured a Static NAT Rule from interface Ethernet0/0 to interface Ethernet 0/1 which NAT the source IPs to the same IPs: 192.168.1.0/24->192.168.1.0/24. Also I have configured a Dynamic NAT Policy that states when destination IP is "server list" then all the source IPs must be translated to 192.168.1.70.
PROBLEM: when testing it...always the static wins....and Dynamic is never analyzed...Also, no priority for the NAT policy and NAT rules can be done on ASDM...what can I do? is there a way to do this on ASDM or CLI? (preferrely at ASDM)
Thanks for your reply and help!

Hello community,
I have the following problem using a ASA with version 8.2.
1) I have this segment on interface Ethernet 0/0: 192.168.1.0/24
2) Through interface Ethernet 0/1 I will reach several servers using the same source IP, but other servers must be reached using only one IP, for example 192.168.1.70
so, I have configured a Static NAT Rule from interface Ethernet0/0 to interface Ethernet 0/1 which NAT the source IPs to the same IPs: 192.168.1.0/24->192.168.1.0/24. Also I have configured a Dynamic NAT Policy that states when destination IP is "server list" then all the source IPs must be translated to 192.168.1.70.
PROBLEM: when testing it...always the static wins....and Dynamic is never analyzed...Also, no priority for the NAT policy and NAT rules can be done on ASDM...what can I do? is there a way to do this on ASDM or CLI? (preferrely at ASDM)
Thanks for your reply and help!

Auto Sync to Manual Sync

How do I change from Auto Sync to Manual Sync in iTunes?

Plug in iPod. In preferences there is a check box to turn on manually managing contents. Forget the exact wording.

Switching forn AUTO undo_management to MANUAL

hi,
1) after AUTO undo_management installation, i will use RBS MANUAL. But when i set the undo_management to MANUAL the database don't start.
What's problem?
2)Where will us use the AUTO or the MANUAL method?
Regards.
Tark.

Hi
You are right... I did a test... here the statement that I used for the switch:
connect / as sysdba
alter system set undo_management = manual scope = spfile;
shutdown
startup
create public rollback segment rbs0 tablespace system;
shutdown
startup
create tablespace rbs datafile '/tmp/rbs.dbf' size 10m;
create public rollback segment rbs1 tablespace rbs;
create public rollback segment rbs2 tablespace rbs;
create public rollback segment rbs3 tablespace rbs;
create public rollback segment rbs4 tablespace rbs;
alter rollback segment rbs1 online;
alter rollback segment rbs2 online;
alter rollback segment rbs3 online;
alter rollback segment rbs4 online;
alter rollback segment rbs0 offline;
Chris

Manual NAT to override Auto NAT

Hi, i've an ASA with this relevant config:
ASA Version 9.1(1)
interface Ethernet0/0
nameif outside
security-level 0
ip address 1.1.1.1 255.255.255.248
object network obj-192.168.2.20
host 192.168.2.20
object network obj-1.1.1.2
host 1.1.1.2
access-list OUT_IN extended permit tcp any4 host 192.168.2.20 eq smtp
access-list OUT_IN extended permit tcp any4 host 192.168.2.20 eq pop3
access-list OUT_IN extended permit tcp any4 host 192.168.2.20 eq imap4
access-list OUT_IN extended permit tcp any4 host 192.168.2.20 eq https
object network obj-192.168.2.20
nat (inside,outside) static obj-1.1.1.2
Now i have to allow access to a web server from a specific Internet Address 2.2.2.2.
Both web server and all other inbound access are made via a different IP Address 1.1.1.2
I'm having some problems configuring this second item, and I need help.
Which is the best way to overcame this problem.
TIA
FR

Hello Fran,
Not sure what you mean:
I mean you already have the policies in place for this:
object network obj-192.168.2.20
nat (inside,outside) static obj-1.1.1.2
access-list OUT_IN extended permit tcp any4 host 192.168.2.20 eq smtp
access-list OUT_IN extended permit tcp any4 host 192.168.2.20 eq pop3
access-list OUT_IN extended permit tcp any4 host 192.168.2.20 eq imap4
access-list OUT_IN extended permit tcp any4 host 192.168.2.20 eq https
Now i have to allow access to a web server from a specific Internet Address 2.2.2.2.
Both web server and all other inbound access are made via a different IP Address 1.1.1.2
So now a user on the outside 2.2.2.2 will be accessing your webserver,
Is your server 192.168.2.20 and also what do you mean by
Both web server and all other inbound access are made via a different IP Address 1.1.1.2
For more information about Core and Security Networking follow my website at http://laguiadelnetworking.com
Any question contact me at [email protected]
Cheers,
Julio Carvajal Segura

Ipsec-manual, NAT-Traversal?

Is there a way in IOS to enabled NAT-Traversal (ESP-UDP) for manually keyed IPsec tunnels?
Thus far, it looks to me like IKE is required for the NAT detection.
In Linux, I can manually create ESP-UDP SA's, I was hoping to be able to do the same in IOS.

It allows ipsec to work through nat?
How did your last post turn out?

Source Nat and Destination Nat

Is any of the above working in the ACE OR CSM module by default?
What is an advantage of configuring destination NAT on the ACE Box?

Hello,
On both the CSM and ACE, destination NAT (a.k.a. server nat) is enabled by default in a serverfarm. Source NAT needs to be manually configured on both devices, as it is not a default configuration.
In server load balancing, destination NAT is very common. When clients connect to a VIP on the load balancer, the load balancer will then choose a real server the send the connection to. The destination IP address of the client-to-server traffic will be NAT'd from the virtual IP address (VIP) to the real server's IP address. The server's reply will be sourced with the real server's IP address, initially. The load balancer will again perform NAT to change the source IP address from the real server's IP address back to the VIP address prior to forwarding the response back to the client. This way, the client only knows about the VIP address, and not the real server's IP address.
Best regards,
Sean

Auto create vs manual TOC

Is there an easy way to change an auto generated TOC to a
manually created one. I'm coming into a project that has the TOC in
alpha order, but I want to change it to be more functional.

Hi writerrh and welcome to our community
As Leon correctly pointed out, you are free to rearrange your
TOC as you like. But I'll also offer the following points that many
seem to be confused about.
* Just because you created a TOC automatically doesn't mean
it's forever an automatically maintained TOC. Many folks have this
mistaken belief. Think of it as a one time shot that instructs
RoboHelp to gather together all the different topics and folders
and create a TOC out of them. Once it's done, that's it. Adding
topics later does not automatically include them in the TOC.
* Some folks believe the TOC absolutely MUST have every topic
referenced. This is seldom the case. You may have tons of topics
that never see the light of day from the TOC.
* Some folks believe deleting a topic from the TOC also
deletes it from the project or causes it not to be included in the
output. This is also a fallacy.
Hopefully this helps a smidge... Rick

Destination NAT and Source Nat

Hi, my network have mobile users with notebooks, and they use public smtp IP address, when they out of office, without VPN ASA works well, but when they comes back in office they should change SMTP IP back to private. I know that my task could be solved via DNS service, but for some reason I should do Dnat and Snat on ASA, please answer me, Is it posible? (Because ASA have to nat and dnat on same interface Insidem and back this traffic to Inside again
)Please see this picture, I draw my task there. Thanks!

Yes it is posible through policy nat.
here is the example.
access−list policy−nat extended permit ip host 10.1.1.20 host 5.5.5.5
global (dmz) 2 192.168.2.2
nat (inside) 2 access-list policy−nat
Hope that helps.
thanks

Handling Auto-provisioning failure Manually?

Hi all,
WE are going with auto-provisioning for ECC and EP systems.
I am looking for some suggestions,incase auto-provisioning failed due to some reason.
I tweaked the connector settings in Portal that will throw some error. Then I configured the escape route for 'Auto Provisioning Failure'. The request goes thro' the escape route to the GRC Admin to fix the auto-provisioning issue. But this is delaying our access provisioning process. I am looking for ways to approve and close the request in case of errors.
Is there a way to let the user provision manually and document the reasons in the comments and close the request?
I should just approve and close the request without triggering auto-provision incase of errors.
Can this be done?
Thanks in advance..
Kee

Hi Siri,
There are two modes in CUP for provisioning manual and auto however it is not possible for approvers to switch between these two. This configuration is applicable only all the requests.
If you have auto provisioning off then in all the request approvers will get "Create User or Assign Role" buttons by which they have to do the manual provisioning.
The error in auto provisioning is not a usual thing which happen in production environment and when this happen this should be corrected immediately. If this take some time you can create system level auto provisioning setting where you can disable the auto provisioning for one system which is causing issue in your environment and provisioning in other system will be working automatically.
Thanks

Auto Sharpening Defaults Manual Sharpening Setting

I always thought that Auto Sharpen had a fancy built in algorythm to analyize the photo and apply the appropriate type & amount of sharpening. Here's what the HELP function has to say about it:
The Auto Sharpen command increases clarity or focus without the risk of oversharpening an image.
Sounds good. HOWEVER, If I sharpen a photo using Enhance>Adjust Sharpness and then set the degree of sharpening that I desire, it somehow changes the settings of the auto sharpen tool. The auto sharpen tool defaults to using the same setting used by the manual sharpening. I found this to be true in both Version 6 & 7. Here's how I discovered it.
I had a photo with a lot of motion blur. I used the manual sharpening tool (Enhance>Adjust Sharpness) and played with it a bit. There was too much motion to fix it to my satisfaction, so just for funzies, I set it to maximal values and hit OK. After closing the photo, I opened a new one, did some basic exposure & color adjustments and then used Auto Sharpen. To my suprise, it used the same maximal motion blur settings that I previously set for the last photo, which way oversharpened my photo.
So this leves me wondering, what does Auto Sharpen do anyway? Does it just remember the last manual sharpening setting and apply it without any analysis of the photo?
Any words of wisdom out there?

I always thought that Auto Sharpen had a fancy built in algorythm to analyize the photo and apply the appropriate type & amount of sharpening. Here's what the HELP function has to say about it:
The Auto Sharpen command increases clarity or focus without the risk of oversharpening an image.
Sounds good. HOWEVER, If I sharpen a photo using Enhance>Adjust Sharpness and then set the degree of sharpening that I desire, it somehow changes the settings of the auto sharpen tool. The auto sharpen tool defaults to using the same setting used by the manual sharpening. I found this to be true in both Version 6 & 7. Here's how I discovered it.
I had a photo with a lot of motion blur. I used the manual sharpening tool (Enhance>Adjust Sharpness) and played with it a bit. There was too much motion to fix it to my satisfaction, so just for funzies, I set it to maximal values and hit OK. After closing the photo, I opened a new one, did some basic exposure & color adjustments and then used Auto Sharpen. To my suprise, it used the same maximal motion blur settings that I previously set for the last photo, which way oversharpened my photo.
So this leves me wondering, what does Auto Sharpen do anyway? Does it just remember the last manual sharpening setting and apply it without any analysis of the photo?
Any words of wisdom out there?

Auto nat vs manual nat

Similar Messages

Maybe you are looking for