思科ASA防火墙8.4版本NAT的配置方法（转自新浪 刀光剑影）

思科ASA防火墙8.4版本NAT的配置方法

ASA防火墙新版本8.4-工程实用手册
注意，现在思科ASA防火墙已经升级到8.4，从8.3开始很多配置都有颠覆性的不同，特别是NAT配置很不一样，使用了object
/object-group的新方式
这里为了大家工程实施起来方便，特别总结了如下NAT应用，希望能够帮助大家。
ASA 8.3 NAT 转化新语法：
Topology
：

L100
200.0.9.10 R1 ---.2----192.168.1.0----.1---ASA----.1----10.10.10.0---.2---R2
L100 100.1.64.1

The order of operations works as configured by each section. In
order:
1. Manual Nat
2. Auto Nat
3. After
Auto

Dynamic NAT/PAT场景一：

所有内网流量访问外网时都转换为接口的公网地址，此环境适用于仅有一个公网地址的小型办公室。

Object network
inside-outside-all

Subnet 0.0.0.0 0.0.0.0

Nat (inside,outside) dynamic
interface

原有的语法
nat (inside) 1 0 0 global
(outside) 1 interface

验证：

ciscoasa(config)# show nat detail

ciscoasa(config)# show xlate

ciscoasa(config)# show conn

场景二

所有内网流量访问外网时都转换为特定的公网地址，此环境适用于的小型办公室或分支办公室。

Object network
inside-outside-all

Subnet 0.0.0.0 0.0.0.0

Nat (inside,outside) dynamic
10.10.10.3

原有的语法
nat (inside) 1 0
0
global (outside) 1 10.10.10.3

场景三
对于有大量公网地址用户，常应用在运营商或者公司内网

Object network
inside-outside-trans

Range 10.10.10.100 10.10.10.200

Object network
inside-outside-all

Subnet 0.0.0.0 0.0.0.0

Nat (inside,outside) static
inside-outside-trans

原有的语法

nat (inside) 1 0 0
global (outside)
1 10.10.10.100 10.10.10.200

场景四
对于有大量公网地址用户，常应用在运营商或者公司内网，为防止地址用完可以配置一个PAT和interface
(推荐)

Object network inside-outside-trans

Range 10.10.10.100
10.10.10.200

Object network inside-outside-PAT

Host
10.10.10.201

Object-group network nat-pat-grp

Network-object object
inside-outside-trans

Network-object object inside-outside-PAT

Object network
inside-outside-all

Subnet 0.0.0.0 0.0.0.0

Nat (inside,outside) dynamic
nat-pat-grp interface

原有的语法

nat (inside) 1 0 0
global (outside)
1 10.10.10.100 10.10.10.200

global (outside) 1 interface

验证方法和结果请查看场景三

Static
NAT/PAT场景五
内网有邮件和Web服务器为远程办公用户提供访问，此环境适用于HQ和分支办公室

object network server-static

host
10.10.10.3

object network
inside-server

host 200.0.9.10

nat (inside,outside) static
server-static

原有语法
static (inside,outside)
10.10.10.3 200.0.9.10 netmask 255.255.255.255

场景六
此环境用户的需求比较复杂，客户在低安全区域有很多提供业务服务的小型机，他需要隐藏被访问的服务器地址，同时要求对外网server的访问进行Static方式一对一的映射。

object network
outside-inside-waiguanju-trans69

host
100.1.64.40

object network waihuiju-des-add3

host
197.0.244.3

object network
outside-inside-waiguanju-shouzhi-shenbaoxitong

host
100.1.95.1

object network waihuiju-des-add4

host
197.0.244.4

object network outside-inside-waiguanju-trans63

host
100.1.95.2

object network waihuiju-des-add5

host
197.0.244.5

object network
outside-inside-waihuiju-zhijietouzi-waihuiyewu-xinxixitong-hz

host
100.1.64.30

object network waihuiju-des-add6

host
197.0.244.6

object network
outside-inside-waihuiju-aoyunyingji-fabuwangzhan

host
100.1.248.40

object network waihuiju-des-add7

host
197.0.244.7

object network
outside-inside-waihuiju-geren-gouhui

host
100.1.248.20

object network waihuiju-des-add8

host
197.0.244.8

object network
outside-inside-waihuiju-jieshouhui-ceshixitong

host
100.1.248.26

object network waihuiju-des-add9

host
197.0.244.9

object network
outside-inside-waihuiju-zhijietouzi-waihuiyewu-xinxixitong1

host
100.1.64.1

object network waihuiju-des-add10

host
197.0.244.10

object network
outside-inside-waihuiju-zhijietouzi-waihuiyewu-xinxixitong2

host
100.1.64.21

object network waihuiju-des-add11

host
197.0.244.11

object network outside-inside-waiguanju-trans12

host
100.1.1.1

object network waihuiju-des-add12

host
197.0.244.12

object network
outside-inside-waiguanju-jieshouhui-tongjixitong

host
100.1.248.17

object network waihuiju-des-add13

host
197.0.244.13

object network outside-inside-ITSxitongceshi

host
100.1.95.4

object network waihuiju-des-add14

host
197.0.244.14

object network outside-inside-waiguanju-trans91

host
100.1.95.5

object network waihuiju-des-add15

host
197.0.244.15

object network waihuiju-tran-add

host
29.2.7.254

object-group network waihuiju-des-add

network-object object
waihuiju-des-add3

network-object object waihuiju-des-add4

network-object object
waihuiju-des-add5

network-object object waihuiju-des-add6

network-object object
waihuiju-des-add7

network-object object waihuiju-des-add8

network-object object
waihuiju-des-add9

network-object object waihuiju-des-add10

network-object object
waihuiju-des-add11

network-object object waihuiju-des-add12

network-object object
waihuiju-des-add13

network-object object waihuiju-des-add14

network-object object
waihuiju-des-add15

object-group network outside-inside-Map

network-object object
outside-inside-waiguanju-trans69

network-object object
outside-inside-waiguanju-shouzhi-shenbaoxitong

network-object object
outside-inside-waiguanju-trans63

network-object object
outside-inside-waihuiju-zhijietouzi-waihuiyewu-xinxixitong-hz

network-object object
outside-inside-waihuiju-aoyunyingji-fabuwangzhan

network-object object
outside-inside-waihuiju-geren-gouhui

network-object object
outside-inside-waihuiju-jieshouhui-ceshixitong

network-object object
outside-inside-waihuiju-zhijietouzi-waihuiyewu-xinxixitong1

network-object object
outside-inside-waihuiju-zhijietouzi-waihuiyewu-xinxixitong2

network-object object
outside-inside-waiguanju-trans12

network-object object
outside-inside-waiguanju-jieshouhui-tongjixitong

network-object object
outside-inside-ITSxitongceshi

network-object object
outside-inside-waiguanju-trans91

nat (inside,outside) source
dynamic any waihuiju-tran-add destination static waihuiju-des-add
outside-inside-Map
验证 ：

ciscoasa# show
xlate

7 in
use, 17 most used

Flags: D - DNS, i - dynamic, r - portmap, s - static, I -
identity, T - twice

NAT from outside:100.1.64.40, 100.1.95.1,
100.1.95.2,

100.1.64.30, 100.1.248.40,
100.1.248.20,

100.1.248.26, 100.1.64.1,
100.1.64.21,

100.1.1.1, 100.1.248.17,
100.1.95.4,

100.1.95.5 to inside:197.0.244.3,
197.0.244.4,

197.0.244.5, 197.0.244.6,
197.0.244.7,

197.0.244.8, 197.0.244.9,
197.0.244.10,

197.0.244.11, 197.0.244.12,
197.0.244.13,

197.0.244.14, 197.0.244.15

flags sT
idle 0:10:32 timeout 0:00:00

TCP PAT from
inside:192.168.1.2/29060 to outside:29.2.7.254/14832 flags ri idle 0:10:47
timeout 0:00:30

TCP PAT from inside:192.168.1.2/20099 to outside:29.2.7.254/50442
flags ri idle 0:11:02 timeout 0:00:30

TCP PAT from
inside:192.168.1.2/32652 to outside:29.2.7.254/19035 flags ri idle 0:11:19
timeout 0:00:30

TCP PAT from inside:192.168.1.2/64367 to outside:29.2.7.254/16920
flags ri idle 0:11:27 timeout 0:00:30

TCP PAT from
inside:192.168.1.2/46218 to outside:29.2.7.254/62293 flags ri idle 0:11:34
timeout 0:00:30

TCP PAT from inside:192.168.1.2/33598 to outside:29.2.7.254/58119
flags ri idle 0:11:50 timeout 0:00:30

ciscoasa# show
conn

6 in
use, 8 most used

TCP outside 197.0.244.6(100.1.64.30):23 inside 192.168.1.2:20099,
idle 0:01:02, bytes 139, flags UFRIO

TCP outside
197.0.244.6(100.1.64.30):23 inside 192.168.1.2:32652, idle 0:01:17, bytes 145,
flags UFRIO

TCP outside 197.0.244.8(100.1.248.20):23 inside 192.168.1.2:46218,
idle 0:01:35, bytes 121, flags UFRIO

TCP outside
197.0.244.10(100.1.64.1):23 inside 192.168.1.2:33598, idle 0:01:51, bytes 121,
flags UFRIO

TCP outside 197.0.244.3(100.1.64.40):23 inside 192.168.1.2:29060,
idle 0:00:48, bytes 121, flags UFRIO

TCP outside
197.0.244.7(100.1.248.40):23 inside 192.168.1.2:64367, idle 0:01:28, bytes 132,
flags UFRIO

ciscoasa# show nat detail

ciscoasa# show nat
detail

Manual
NAT Policies (Section 1)

1 (inside) to (outside) source dynamic any waihuiju-tran-add
destination static waihuiju-des-add outside-inside-Map

translate_hits = 8, untranslate_hits = 8

Source -
Origin: 0.0.0.0/0, Translated: 29.2.7.254/32

Destination - Origin: 197.0.244.3/32, 197.0.244.4/32, 197.0.244.5/32,
197.0.244.6/32

197.0.244.7/32, 197.0.244.8/32, 197.0.244.9/32,
197.0.244.10/32

197.0.244.11/32, 197.0.244.12/32,
197.0.244.13/32, 197.0.244.14/32

197.0.244.15/32, Translated: 100.1.64.40/32, 100.1.95.1/32, 100.1.95.2/32,
100.1.64.30/32

100.1.248.40/32, 100.1.248.20/32,
100.1.248.26/32, 100.1.64.1/32

100.1.64.21/32, 100.1.1.1/32, 100.1.248.17/32, 100.1.95.4/32

100.1.95.5/32

场景七
对通过防火墙的业务流量，不更改源地址，也就是将源地址NAT自己，我们称为identity
NAT。

object network inside-nonat

host
192.168.1.2

nat (inside,outside) static 192.168.1.2

验证：

ciscoasa(config)# show
xlate

1 in use, 17 most
used

Flags: D
- DNS, i - dynamic, r - portmap, s - static, I - identity, T -
twice

NAT
from inside:192.168.1.2 to outside:192.168.1.2

flags sI
idle 0:02:09 timeout 0:00:00

ciscoasa(config)# show
conn

1 in
use, 8 most used

TCP outside 100.1.64.1:23 inside 192.168.1.2:65450, idle 0:00:12,
bytes 115, flags UIO

ciscoasa(config)# show nat detail

Auto NAT Policies (Section
2)

1 (inside)
to (outside) source static inside-nonat 192.168.1.2

translate_hits = 3, untranslate_hits = 0

Source -
Origin: 192.168.1.2/32, Translated: 192.168.1.2/32

Router# who

Line User Host(s) Idle Location

* 0 con
0 idle 00:00:00

6 vty
0 idle 00:00:07 192.168.1.2

注意：
Nat-control 不在使用

如果要开启需要使用下面的语法：
object
network obj_any subnet 0.0.0.0 0.0.0.0
nat (inside,outside) dynamic
obj-0.0.0.0
object network
obj-0.0.0.0
host
0.0.0.0
object network obj_any-01
subnet 0.0.0.0 0.0.0.0
nat (inside,mgmt) dynamic obj-0.0.0.0
object network obj_any-02
subnet 0.0.0.0 0.0.0.0
nat (inside,dmz) dynamic obj-0.0.0.0
object network obj_any-03
subnet 0.0.0.0 0.0.0.0
nat (mgmt,outside) dynamic
obj-0.0.0.0
object network
obj_any-04
subnet 0.0.0.0
0.0.0.0
nat (dmz,outside) dynamic
obj-0.0.0.0
object network
obj_any-05
subnet 0.0.0.0
0.0.0.0
nat (dmz,mgmt) dynamic
obj-0.0.0.0

ASA 8.3 后需要使用真实IP 作为ACL 条目.
ASA 8.3
NAT need real ip address on access-list .Please refer to new migrate on ASA 8.3
NAT commands. For example:

Old Configuration
static
(inside,outside) 172.23.57.1 10.50.50.50 netmask 255.255.255.255

access-list 1 permit ip any
host 172.23.57.1
access-group 1 in interface
outside

Migrated Configuration

access-list 1 permit ip any
host 10.50.50.50
access-group 1 in interface
outside
注意事项:
更新ASA
8.3 NAT 新注意事项 如果做多公网IP 对 一个内网IP的时候SNAT 请大家打开inspect icmp. 切记

常用排错命令：
show run nat
show run
object-network
show run
object-group
show nat detail
show xlate
show conn
show nat pool
debug nat
255