Manual NAT to override Auto NAT

Hi, i've an ASA with this relevant config:
ASA Version 9.1(1)
interface Ethernet0/0
nameif outside
security-level 0
ip address 1.1.1.1 255.255.255.248
object network obj-192.168.2.20
host 192.168.2.20
object network obj-1.1.1.2
host 1.1.1.2
access-list OUT_IN extended permit tcp any4 host 192.168.2.20 eq smtp
access-list OUT_IN extended permit tcp any4 host 192.168.2.20 eq pop3
access-list OUT_IN extended permit tcp any4 host 192.168.2.20 eq imap4
access-list OUT_IN extended permit tcp any4 host 192.168.2.20 eq https
object network obj-192.168.2.20
nat (inside,outside) static obj-1.1.1.2
Now i have to allow access to a web server from a specific Internet Address 2.2.2.2.
Both web server and all other inbound access are made via a different IP Address 1.1.1.2
I'm having some problems configuring this second item, and I need help.
Which is the best way to overcame this problem.
TIA
FR

Hello Fran,
Not sure what you mean:
I mean you already have the policies in place for this:
object network obj-192.168.2.20
nat (inside,outside) static obj-1.1.1.2
access-list OUT_IN extended permit tcp any4 host 192.168.2.20 eq smtp
access-list OUT_IN extended permit tcp any4 host 192.168.2.20 eq pop3
access-list OUT_IN extended permit tcp any4 host 192.168.2.20 eq imap4
access-list OUT_IN extended permit tcp any4 host 192.168.2.20 eq https
Now i have to allow access to a web server from a specific Internet Address 2.2.2.2.
Both web server and all other inbound access are made via a different IP Address 1.1.1.2
So now a user on the outside 2.2.2.2 will be accessing your webserver,
Is your server 192.168.2.20 and also what do you mean by
Both web server and all other inbound access are made via a different IP Address 1.1.1.2
For more information about Core and Security Networking follow my website at http://laguiadelnetworking.com
Any question contact me at [email protected]
Cheers,
Julio Carvajal Segura

Similar Messages

Auto nat vs manual nat

Some how I have ended up with multiple network objects for the same network example
obj-192.168.1.0
obj-192.168.1.0-1
obj-192.168.1.0-2
All are for the same network but have different nat statements. When I look at my NAT statements I have a bunch of manual NAT and Network object NAT rules. I'm pretty confussed on the two. Should I just have one auto nat statement for each object? Then if I need another NAT statement for the same network make it a manual nat?

Would I be correct to presume you have updated/upgraded the ASA software from pre 8.3 to post 8.3 by letting the ASA convert the configuration by itself and not actual write the configurations yourself?
If that is true then it would seem to me that these configurations might be the 8.3 (and later) softwares way of doing Identity NAT between your local ASA interfaces. (Which can also be done with Twice NAT / Manual NAT)
I would for example guess that the following configuration
object network obj-172.16.0.0-05
subnet 172.16.0.0 255.254.0.0
nat (inside,TM) static 172.16.0.0
Before was this
static (inside,TM) 172.16.0.0 172.16.0.0 netmask 255.254.0.0
In the new software 8.3+ if you have local LAN and DMZ interfaces on the ASA which dont require NAT between them, you can simply leave out the NAT configurations. So if your purpose is to enable communication between local interfaces wihtout modifying the source or destination address then I would leave out all those NAT configurations.
In the very basic setups you only really need to perform NAT between the local and public interfaces. The new ASA software doesnt have any "nat-control" anymore. If there is no NAT rule for the traffic incoming to the ASA then the ASA will simply pass it along without NAT.
- Jouni

Moving Manual NAT to section 3 (after auto nat)

Hi All,
We have 3 sections of NAT
1>Manual NAT
2>Auto NAT
3>Manual NAt after Auto.
Lets say on ASA we config Manual and Auto Nat.
Now Order of NAT is
1>Manual
2>Auto
If i move the Manual NAT to section 3 of NAT which is Manual NAT after auto NAT.
Now Order of NAT is
2>Auto
3>Manual NAT after Auto.
Now when i try to do Process Manual NATafter auto section number 3 it does not work as it hits Auto NAt and does not go down.
Need to know the reason behind this?
Regards
MAhesh

Also as a little side note,
There is also difference in the ordering of the NAT configurations depending on the Section
Section 1 and Section 3 Manual NAT rules are always gone through in the order you see them in the actual CLI configuration. So you might have 2 completely working rules BUT if they are in the wrong order it might be that other one of them is never used
Section 2 Auto NAT rules are processed in an order that you dont usually decide yourself. The ASA puts them in order according to how they were configured.
So in a nutshell. You can manually set the order of the Manual NAT rules but Auto NAT rules are ordered automatically by the ASA itself.
You can see the current order of the Auto NAT rules with the command
show nat
- Jouni

Manual Nat (twice Nat) Answers

There seems to be a large number of the subject queries in one form or another. Having acquired an asa 5505 and using 8.43 firmware and the ADSM gui for router configuration it has not been an easy transition from other products.   I have come to understand embedded NAT objects for basic port forwarding but am at a loss on configuring twice nat or manual nat, not really ever dealing with it before, or in this manner.
What I would like to suggest to the experts and to those with the ability to give advice to document editers is to include far more ADSM web gui examples and discussion for manual nat.   The tools are all there - in the nat rules editing page, the display of the rules pictorially and the packet flow at the bottom of the page (and finally thru packet tracing).   What is needed is more on the actual entries on the nat editing pages and the logic and explanation of those entries.   In this forum what I would like to see is when there are responses that they include both the CLI recommended entries b AND the associated adsm web gui pics. With good documents for reading and examples in the forum, I think there should be much less confusion allowing more attention to some very complex scenarios.   I personally feel a bit embarrassed to be asking basic questions and appreciate the responses but with improvements in docs and forum answers the number of such questions should drop. At the very least I and others like me will get better edumecated.    To be clear am not looking for the easy cookie cutter right answers, I am looking to understand CIsco packet routing through explanations of the web gui entries. In fact, I am learning far more by trying to understand the web gui vice simply copying and entering CLI commands. In terms of documents, for example, there should be a very thorough explanation of the relationship between "Translated Addr:" in the first NAT editing page with "Destination Inteface" in the second Advanced page .
Thanks.
Examples below of what I am talking about (note examples are simple embedded NAT object (port forwarding rules). I can finally handle external users requiring access to internal servers. :-) But that is just the surface.
I have added the packet tracing jpegs for further context. There is an UNNAT lookup entry (first trace block, out of view on the pic) a concept which is missing in the documentation I've read that needs to be added but it is illuminating in how the router handles traffic.   What is also interesting is the fourth jpeg which also shows the flow designation of a packet and its handling internally (new packet or one that is associated with an existing packet (previously identified and put in an appropriate table xlate etc)).

Hi,
I've personally always preferred using CLI over GUI. Probably comes due to the fact I started with old Cisco switches and routers.
When I first used a Cisco PIX the switch from switches/routers was a bit hard. The configuration format in 6.x was totally different from the IOS. After I upgraded the first PIX to software 7.0 it was abit more familiar already. Interfaces were now configured like in the switches and routers. Also the permitting traffic through the device used access-lists.
I was just beginning to handle all the different NAT setups (atleast the ones we run into) and then came 8.3 (and 8.4) which totally changed the NAT configuration format
I still find myself configuring the NAT through CLI. I use the CLI because I like beeing able to see the whole device configuration without jumping from tab to tab and clicking drop down menus. I mostly use ASDM to edit existing configurations or something that might not be as familiar with. Though my goal usually is to learn to configure the same from the CLI after I've done it a couple of times from GUI interface.
If you're only using ASDM GUI to configure the ASA, I suggest you go "Tools -> Preferences" and from there enable the option "Preview commands before sending them to the device" This will basicly show you all configurations that you are going to apply in the CLI format. I think this preview setting is off by default.
EDIT2: One really helpfull thing is also the fact that you can get help for almost every configuration page on the ASDM GUI. I think theres almost always a direct "Help" button that opens information about the configuration page in question and clarifies all the options you have on the page. Again, as I haven't used much ASDM, I dont know if they clarify the things you are asking for.
The first 2 pictures to my understanding illustrate the configuration of a port forwarding using the "outside" interfaces address.
The first pictures Translated Address just refers that you are going to use the "outside" interfaces IP address (whatever it might be) to configure a NAT. The ASDM has a habit of giving names to IP addresses which can confuse you. The same line might as well contain an IP address in numeric format if you for example had a small public subnet at your disposal for NAT translations.
The second pictures source/destination interface just basically tells you the interfaces between which the NAT is beeing performed. Either of these can also be specified as "any".
I'll give you a couple of examples
EXAMPLE 1
The below configuration basicly tells the ASA that it will PAT all outbound (outside) traffic from the source networks defined in the object-group to the outside interface address. It also tells that the source interface can be any interface on the ASA.
So basically if you keep adding interfaces to an ASA that need (Or networks behind them) default PAT translations when they use the Internet, you can just keep adding "network-object x.x.x.x y.y.y.y" statements with the new networks under the object-group and the ASA will do PAT for them. You wont have to configure any additional NAT statements.
object-group network DEFAULT-PAT-SOURCE-NETWORKS
description Source Networks for PAT
network-object 10.10.10.0 255.255.255.0
network-object 192.168.0.0 255.255.255.0
network-object 172.16.8.0 255.255.255.0
nat (any,outside) after-auto source dynamic DEFAULT-PAT-SOURCE-NETWORKS interface
EXAMPLE 2
The below configuration basically tells the ASA that the DMZ server will be visible to other hosts behind other ASA interface with the same NAT ip of "1.2.3.4". This could apply to situations where you want to access the DMZ server with the same public IP address from both the Internet and the LAN.
This could help with situations where your LAN uses public DNS and that DNS points to the servers public IP address. With this NAT configuration even though you LAN hosts are connecting to a public IP address the device will still be accessible from the LAN since you're NATing the DMZ server towards all interfaces.
object-network DMZ-PUBLIC-STATIC
description Static Public IP for DMZ server
host 192.168.10.10
nat (dmz,any) static 1.2.3.4 dns
The UN-NAT section to my understanding just tells you that a connection coming from outside to a NAT IP is basically forwarded to the actual lan host IP address and not the public IP the user was originally connecting to.
To be honest I don't really know how to configure well with the ASDM as I usually just use the CLI. Because of that I'm sometimes at a loss on how to configure the most simple things because I've only done them on the CLI.
Hope some of this was helpfull to you
EDIT: Didn't realize I wrote so much
- Jouni

Identifying Manual NAT in ASDM

Hi Everyone,
Below is the screenshot from Cisco LEarning Website for ASA Practice test.
Correct answer is Manual NAT polices .
Need to know what should i look for in ASDM that will tell me it is Manual NAT?
Regards
MAhesh
Message was edited by: mahesh parmar

It is manual because the screenshot shows that there are no Network Object NAT rules. So the displayed NAT rule is of type #3 in the list below.
In ASA 8.3 or later there are 3 types of NAT rules you can add:
1. Manual NAT before Network-object NAT
2. Network-Object NAT (network-object NAT is also known as AutoNAT)
3. Manual NAT after Network-object NAT.
If you looked at the cli, it would have the keyword "after-auto" in the NAT rule.

Example of Manual NAT to implement NAT exemption

Hi Everyone,
Below is from Cisco LEarning Network site
Referring to the Cisco ASA NAT configuration below
object network one
subnet 10.1.1.0 255.255.255.0
object network two
subnet 192.168.1.0 255.255.255.0
nat (inside,outside) source static one one destination static two two
Need to understand how below answer is correct?
This is an example of Cisco ASA 8.3 manual NAT to implement NAT exemption.
Regards
MAhesh

Hi Mahesh,
Yes, the above configuration achieves a NAT0 type configuration in the new 8.3+ ASA softwares.
In the 8.2 and older softwares we used an ACL to tell the ASA between which networks there should be no translation to the source address.
The above configuration could correspond to the following on the 8.2 software
access-list INSIDE-NAT0 permit ip 10.1.1.0 255.255.255.0 192.168.1.0 255.255.255.0
nat (inside) 0 access-list INSIDE-NAT0
And as you have already mentioned the 8.3+ format is
object network one
subnet 10.1.1.0 255.255.255.0
object network two
subnet 192.168.1.0 255.255.255.0
nat (inside,outside) source static one one destination static two two
In the new format you see the same things as you saw in the older format using ACL. It tells between which interfaces this NAT applies. It also tells between which source and destination networks this applies.
Now lets look at the above "nat" statement in all of its parts
nat = Is the actual command which starts the NAT configuration whatever NAT you were configuring
inside = Is the source interface for the NAT as its mentioned first
outside = Is the destination interface for the NAT its mentioned second
source = Simply specifies that the source parameters for this NAT configuration will follow
static = Defines that were doing a Static type of NAT
one = Defines the real source network
one = Defines the mapped source network
destination = Simply specifies that the destination parameters for this NAT configuration will follow
static = Defines that the destination is static. It can only be static
two = Defines the mapped destination network
two = Defines the real destination network
And the key things to notice from the configuration.
Both source and destination real and mapped networks are the same. This means that the source network and destination network should stay unchanged. So in essence we are doing NAT0.
When we add the "destination static " this automatically means that the NAT will only be applied when the destination of the traffic is this network. This naturally applies in the reverse direction since the rule is bidirectional.
I am not really sure if I explained the above in the best way I could. Hope it makes any sense
- Jouni

Manually override auto off

in my old BB i was able to override auto off by using the on button on top. but with my Curve, when i set auto offf for 11 pm i am unable to manually turn the phone on until the auto on time is reached. anyone know how to fix this?

Hello
Welcome to the Community
May we know your device OS version and if you recently upgraded your device OS?
Thanks,
Ron
Click "Accept as Solution" if your problem is solved. To give thanks, click thumbs up Blackberry Battery Saving Tips | Follow me on Twitter

Override Auto Cache Management

Not really a problem, as such.. but something that is a little annoying.
The Override Auto Cache Management option doesn't seem to work properly, unless what is happening SHOULD be happening?
Basically, by default it is set to 75Mb.. I'll set it to around 350-400Mb. However, at random intervals, Firefox will default the settings back to 75Mb, out of the blue. No warning or anything.
Why does is keep defaulting back to 75Mb? I have also changed the option using About:Config with the 'browser.cache.disk.capacity' option. but it still defaults back to 75Mb.
Is there anything I could be doing wrong? Another setting that needs to be changed? Any help will be appreciated. Thanks.

The cache size usually ends up around 350 MB, unless you have very little free disk space. I suggest you start over:
# Type ''about:config'' into the address bar and press Enter.
# Press the big button to bypass the warning.
# In the search box, type ''browser.cache.''
# In the search results, right-click each entry with the status "user set" and choose '''Reset'''.
# Type ''about:cache'' into the address bar and press Enter. Under the "Disk cache device" category, note the value of the '''Cache Directory'''. Open that folder in Windows Explorer.
# Exit Firefox (click the Firefox button in the top left corner, then choose Exit).
# Delete the cache folder you opened earlier.
# Restart Firefox.
At that point, your cache size should be set to something more sensible. Note that under [[Advanced settings for accessibility, browsing, system defaults, network, updates, and encryption|Options - Advanced - Network]], the number box shows the maximum cache size, while the text above it shows how much is currently stored.<br>
If you still need to override the automatic size, then normally all you need to do is check "Override automatic cache management", specify a custom size below, then click the OK button.<br>
Doing so would save the first preference as ''browser.cache.disk.smart_size.enabled'' with a value of '''false''', and the second as ''browser.cache.disk.capacity'' with a value in [http://en.wikipedia.org/wiki/Kibibyte kibibytes]. To avoid unintended effects, it's best to avoid modifying about:config preferences (at least in this case).
If your preferences are lost after restarting Firefox, see the following article:
* [[How to fix preferences that won't save]]

Ipsec-manual, NAT-Traversal?

Is there a way in IOS to enabled NAT-Traversal (ESP-UDP) for manually keyed IPsec tunnels?
Thus far, it looks to me like IKE is required for the NAT detection.
In Linux, I can manually create ESP-UDP SA's, I was hoping to be able to do the same in IOS.

It allows ipsec to work through nat?
How did your last post turn out?

How can I manually update Firefox? Auto updates fail and end up making my computer hang for 10 minutes on startup.

Firefox, after starting up my computer, fails the autoupdate every day. It leaves my computer hanging much longer than I would enjoy. I would like to know how I can manually update firefox and/or prevent future issues.
== This happened ==
Every time Firefox opened
== 3.6.2 or a little before.

BUT I CAN'T UPDATE TO BEGIN WITH
L2R

Manual Music.. Auto Update Rating?

Hey, so here is my problem.
I'm manually managing my music on my iPod. I don't mess with the song ratings on iTunes at all. I adjust them on my iPod nano. But when I sync it back up with iTunes, the ratings don't get updated. Is there anyway I can get my iTunes song ratings and my iPod song ratings in sync?

well, I, like you update my nano manually. I have noticed this happening but it doesn't if you don't add new songs to your nano, as when you add a song/songs it updates iPod and your iTunes ratings (i think, correct me if i'm wrong).
hope this helps in some way
jid

Manually manage music but auto-sync one playlist?

Ok so basically, I'm trying to figure out if there is a way to manually manage my itunes library but automatcially sync one of my playlists. The reason being is that I have on artists that constantly changes (assorted singles) which is just a collection of different artists' singles. It would be nice to have itunes automatically sync that one playlist but allow me to maintain control of the rest of the library.
Otherwise, my only way to get around this is to create a folder that contains playlists for all the albums/artists I want to sync and have itunes autmotically sync everything that folder?????

It would be nice to have itunes automatically sync that one playlist but allow me to maintain control of the rest of the library.
Simple.
Uncheck Manually manage music and videos.
Select the Music tab.
Tick Sync music and Sync selected playlists.
Tick the playlist you want.
Drag the other music you want to the iDevice.

Pidgin: Need way to override auto "Do Not Disturb" Status when in meeting

As my team found out this morning, there is a feature in the Beehive / Pidgin integration that automatically sets the Pidgin status to "Do Not Disturb" when there is a meeting on your calendar. Problem is there is no way to override this. In fact, unless someone tells you, you don't even know it is occuring. It is in the FAQ section and say it cannot be overriden. Well I was in my weekly hour long meeting this morning - It lasted for 10 minutes yet all 12 of us in the meeting had a status of Do Not Disturb for a whole hour.
I think it is ok to automiatically change to Do Not Disturb, but the user should be able to change it back whenever they want. If the meeting ends early for example.
There needs to be a way to do this or they should disable this feature! I have already received a bunch of email from other members of my team.
What is the best way to provide feedback to the Beehive team?
This is one of those "Looks Good on Paper" but not in the "Real World"

Hi
If you are an Oracle employee please post your questions / remarks on the following forum
Otherwise you can always contact the support and ask for an enhancement request
Regards,
Fred

Disable/Override Auto-detect for displays

i have a mini serving as the head for my media center. if i plug it into the HDTV via a DVI->HDMI cable it works just fine. detects the HDTV display options perfectly.
but what i would like to do is plug it into my receiver, where all the rest of my audio and video can go as well. that way i just have one video out to the tv for all my sources.
the problem is that when i plug it into the receiver i get generic display options on the mac (none of the HDTV resolutions) and the receiver doesn't know what to do with them. nothing is passed back out to the TV.
various cables, resolutions, and third-party software for playing with video output options have been tried. i'm hoping that, if there is a way to disable auto-detect for displays, i can output 720P/1080i as such and the receiver will recognize it and send it out to the TV.

Hi,
Thanks for posting your issue in the forum.
Regarding the current issue, I suggest we could refer to the following similar threads to disable Automatically detect settings via Group Policy. They may be useful to us.
Turn off Auto Detect Settings in IE using GPO
http://social.technet.microsoft.com/Forums/en-US/winserverGP/thread/cb6abb30-4360-4d3d-93fc-61823b2a5c20
IE LAN Settings: "Automatically detect settings"
http://social.technet.microsoft.com/Forums/en-US/winserverGP/thread/5a8a47fd-ab72-488c-bfad-d8c10d18b6be/
Hope this helps.
Best Regards,
Andy Qi
TechNet Subscriber Support
If you are
TechNet Subscription user and have any feedback
on our support quality, please send your feedback here.
Andy Qi
TechNet Community Support

Manually sync videos but auto sync music?

Anyone know how to do this? When I uncheck the "sync videos" command on ipod preferences, it erases all my videos from my ipod and won't let me manually drag the ones I want onto it.
If I check the "manually manage music and videos" button, it also unsyncs my music, and when I try to click the "sync music" button, it deletes all my manually added videos...
Any ideas? Videos take up lots of space on my comp, so I would like to put them on my ipod and delete them from itunes so they use up less space, but I would like my music to continue automatically updating...all help appreciated!
Thanks!

I'm sorry, I guess I didn't fully understand your sync/delete method for videos. I'm not sure I know of a way to work around this dilemma short of manually updating your iPod.
If you have to resort to manually managing your files, you could resort to the "playlist" update option:
Try creating playlist(s) and syncing only those playlists.
Select the iPod in iTunes. Click the Music tab.
Tick Sync music and Selected playlists.
Tick the playlists you want on the iPod.
Then just Add/Delete from those playlists and plug in the iPod.
When you add a video and delete it from your library things won't get erased this way.

Manual NAT to override Auto NAT

Similar Messages

Maybe you are looking for