思科ASA防火墙8.4版本NAT的配置方法（转自新浪 刀光剑影）

• 思科ASA防火墙8.4版本NAT的配置方法

• 
   
  ASA防火墙新版本8.4-工程实用手册
  注意，现在思科ASA防火墙已经升级到8.4，从8.3开始很多配置都有颠覆性的不同，特别是NAT配置很不一样，使用了object /object-group的新方式
  这里为了大家工程实施起来方便，特别总结了如下NAT应用，希望能够帮助大家。
  ASA 8.3 NAT 转化新语法：
  Topology ：
   
  L100 200.0.9.10 R1 ---.2----192.168.1.0----.1---ASA----.1----10.10.10.0---.2---R2 L100 100.1.64.1
   
  The order of operations works as configured by each section. In order:
   1. Manual Nat
   2. Auto Nat
   3. After Auto
   
  Dynamic NAT/PAT场景一：
   
  所有内网流量访问外网时都转换为接口的公网地址，此环境适用于仅有一个公网地址的小型办公室。
   
  Object network inside-outside-all
   
  Subnet 0.0.0.0 0.0.0.0
   
  Nat (inside,outside) dynamic interface
   
  原有的语法
  nat (inside) 1 0 0 global (outside) 1 interface
   
  验证：
   
  ciscoasa(config)# show nat detail
   
  
   
  ciscoasa(config)# show xlate
   
  
   
  ciscoasa(config)# show conn
   
  
   
  场景二
   
  所有内网流量访问外网时都转换为特定的公网地址，此环境适用于的小型办公室或分支办公室。
   
  Object network inside-outside-all
   
  Subnet 0.0.0.0 0.0.0.0
   
  Nat (inside,outside) dynamic 10.10.10.3
   
  原有的语法
  nat (inside) 1 0 0
  global (outside) 1 10.10.10.3
   
  
  
  场景三
  对于有大量公网地址用户，常应用在运营商或者公司内网
   
  Object network inside-outside-trans
   
  Range 10.10.10.100 10.10.10.200
   
  Object network inside-outside-all
   
  Subnet 0.0.0.0 0.0.0.0
   
  Nat (inside,outside) static inside-outside-trans
   
  原有的语法
   
  nat (inside) 1 0 0
  global (outside) 1 10.10.10.100 10.10.10.200
   
  
  场景四
  对于有大量公网地址用户，常应用在运营商或者公司内网，为防止地址用完可以配置一个PAT和interface (推荐)
   
  Object network inside-outside-trans
   
  Range 10.10.10.100 10.10.10.200
   
  Object network inside-outside-PAT
   
  Host 10.10.10.201
   
  Object-group network nat-pat-grp
   
  Network-object object inside-outside-trans
   
  Network-object object inside-outside-PAT
   
  Object network inside-outside-all
   
  Subnet 0.0.0.0 0.0.0.0
   
  Nat (inside,outside) dynamic nat-pat-grp interface
   
  原有的语法
   
  nat (inside) 1 0 0
  global (outside) 1 10.10.10.100 10.10.10.200
   
  global (outside) 1 interface
   
  验证方法和结果请查看场景三
   
  Static NAT/PAT场景五
  内网有邮件和Web服务器为远程办公用户提供访问，此环境适用于HQ和分支办公室
   
  object network server-static
   
  host 10.10.10.3
   
  object network inside-server
   
  host 200.0.9.10
   
  nat (inside,outside) static server-static
   
   
   
  原有语法
  static (inside,outside) 10.10.10.3 200.0.9.10 netmask 255.255.255.255
   
  
   
  场景六
  此环境用户的需求比较复杂，客户在低安全区域有很多提供业务服务的小型机，他需要隐藏被访问的服务器地址，同时要求对外网server的访问进行Static方式一对一的映射。
   
  object network outside-inside-waiguanju-trans69
   
  host 100.1.64.40
   
  object network waihuiju-des-add3
   
  host 197.0.244.3
   
  object network outside-inside-waiguanju-shouzhi-shenbaoxitong
   
  host 100.1.95.1
   
  object network waihuiju-des-add4
   
  host 197.0.244.4
   
  object network outside-inside-waiguanju-trans63
   
  host 100.1.95.2
   
  object network waihuiju-des-add5
   
  host 197.0.244.5
   
  object network outside-inside-waihuiju-zhijietouzi-waihuiyewu-xinxixitong-hz
   
  host 100.1.64.30
   
  object network waihuiju-des-add6
   
  host 197.0.244.6
   
  object network outside-inside-waihuiju-aoyunyingji-fabuwangzhan
   
  host 100.1.248.40
   
  object network waihuiju-des-add7
   
  host 197.0.244.7
   
  object network outside-inside-waihuiju-geren-gouhui
   
  host 100.1.248.20
   
  object network waihuiju-des-add8
   
  host 197.0.244.8
   
  object network outside-inside-waihuiju-jieshouhui-ceshixitong
   
  host 100.1.248.26
   
  object network waihuiju-des-add9
   
  host 197.0.244.9
   
  object network outside-inside-waihuiju-zhijietouzi-waihuiyewu-xinxixitong1
   
  host 100.1.64.1
   
  object network waihuiju-des-add10
   
  host 197.0.244.10
   
  object network outside-inside-waihuiju-zhijietouzi-waihuiyewu-xinxixitong2
   
  host 100.1.64.21
   
  object network waihuiju-des-add11
   
  host 197.0.244.11
   
  object network outside-inside-waiguanju-trans12
   
  host 100.1.1.1
   
  object network waihuiju-des-add12
   
  host 197.0.244.12
   
  object network outside-inside-waiguanju-jieshouhui-tongjixitong
   
  host 100.1.248.17
   
  object network waihuiju-des-add13
   
  host 197.0.244.13
   
  object network outside-inside-ITSxitongceshi
   
  host 100.1.95.4
   
  object network waihuiju-des-add14
   
  host 197.0.244.14
   
  object network outside-inside-waiguanju-trans91
   
  host 100.1.95.5
   
  object network waihuiju-des-add15
   
  host 197.0.244.15
   
  object network waihuiju-tran-add
   
  host 29.2.7.254
   
  object-group network waihuiju-des-add
   
  network-object object waihuiju-des-add3
   
  network-object object waihuiju-des-add4
   
  network-object object waihuiju-des-add5
   
  network-object object waihuiju-des-add6
   
  network-object object waihuiju-des-add7
   
  network-object object waihuiju-des-add8
   
  network-object object waihuiju-des-add9
   
  network-object object waihuiju-des-add10
   
  network-object object waihuiju-des-add11
   
  network-object object waihuiju-des-add12
   
  network-object object waihuiju-des-add13
   
  network-object object waihuiju-des-add14
   
  network-object object waihuiju-des-add15
   
  object-group network outside-inside-Map
   
  network-object object outside-inside-waiguanju-trans69
   
  network-object object outside-inside-waiguanju-shouzhi-shenbaoxitong
   
  network-object object outside-inside-waiguanju-trans63
   
  network-object object outside-inside-waihuiju-zhijietouzi-waihuiyewu-xinxixitong-hz
   
  network-object object outside-inside-waihuiju-aoyunyingji-fabuwangzhan
   
  network-object object outside-inside-waihuiju-geren-gouhui
   
  network-object object outside-inside-waihuiju-jieshouhui-ceshixitong
   
  network-object object outside-inside-waihuiju-zhijietouzi-waihuiyewu-xinxixitong1
   
  network-object object outside-inside-waihuiju-zhijietouzi-waihuiyewu-xinxixitong2
   
  network-object object outside-inside-waiguanju-trans12
   
  network-object object outside-inside-waiguanju-jieshouhui-tongjixitong
   
  network-object object outside-inside-ITSxitongceshi
   
  network-object object outside-inside-waiguanju-trans91
   
  nat (inside,outside) source dynamic any waihuiju-tran-add destination static waihuiju-des-add outside-inside-Map
  验证 ：
   
  ciscoasa# show xlate
   
  7 in use, 17 most used
   
  Flags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twice
   
  NAT from outside:100.1.64.40, 100.1.95.1, 100.1.95.2,
   
     100.1.64.30, 100.1.248.40, 100.1.248.20,
   
     100.1.248.26, 100.1.64.1, 100.1.64.21,
   
     100.1.1.1, 100.1.248.17, 100.1.95.4,
   
     100.1.95.5 to inside:197.0.244.3, 197.0.244.4,
   
     197.0.244.5, 197.0.244.6, 197.0.244.7,
   
     197.0.244.8, 197.0.244.9, 197.0.244.10,
   
     197.0.244.11, 197.0.244.12, 197.0.244.13,
   
     197.0.244.14, 197.0.244.15
   
     flags sT idle 0:10:32 timeout 0:00:00
   
  TCP PAT from inside:192.168.1.2/29060 to outside:29.2.7.254/14832 flags ri idle 0:10:47 timeout 0:00:30
   
  TCP PAT from inside:192.168.1.2/20099 to outside:29.2.7.254/50442 flags ri idle 0:11:02 timeout 0:00:30
   
  TCP PAT from inside:192.168.1.2/32652 to outside:29.2.7.254/19035 flags ri idle 0:11:19 timeout 0:00:30
   
  TCP PAT from inside:192.168.1.2/64367 to outside:29.2.7.254/16920 flags ri idle 0:11:27 timeout 0:00:30
   
  TCP PAT from inside:192.168.1.2/46218 to outside:29.2.7.254/62293 flags ri idle 0:11:34 timeout 0:00:30
   
  TCP PAT from inside:192.168.1.2/33598 to outside:29.2.7.254/58119 flags ri idle 0:11:50 timeout 0:00:30
   
  ciscoasa# show conn
   
  6 in use, 8 most used
   
  TCP outside 197.0.244.6(100.1.64.30):23 inside 192.168.1.2:20099, idle 0:01:02, bytes 139, flags UFRIO
   
  TCP outside 197.0.244.6(100.1.64.30):23 inside 192.168.1.2:32652, idle 0:01:17, bytes 145, flags UFRIO
   
  TCP outside 197.0.244.8(100.1.248.20):23 inside 192.168.1.2:46218, idle 0:01:35, bytes 121, flags UFRIO
   
  TCP outside 197.0.244.10(100.1.64.1):23 inside 192.168.1.2:33598, idle 0:01:51, bytes 121, flags UFRIO
   
  TCP outside 197.0.244.3(100.1.64.40):23 inside 192.168.1.2:29060, idle 0:00:48, bytes 121, flags UFRIO
   
  TCP outside 197.0.244.7(100.1.248.40):23 inside 192.168.1.2:64367, idle 0:01:28, bytes 132, flags UFRIO
   
  ciscoasa# show nat detail
   
  ciscoasa# show nat detail
   
  Manual NAT Policies (Section 1)
   
  1 (inside) to (outside) source dynamic any waihuiju-tran-add destination static waihuiju-des-add outside-inside-Map
   
     translate_hits = 8, untranslate_hits = 8
   
     Source - Origin: 0.0.0.0/0, Translated: 29.2.7.254/32
   
     Destination - Origin: 197.0.244.3/32, 197.0.244.4/32, 197.0.244.5/32, 197.0.244.6/32
   
     197.0.244.7/32, 197.0.244.8/32, 197.0.244.9/32, 197.0.244.10/32
   
     197.0.244.11/32, 197.0.244.12/32, 197.0.244.13/32, 197.0.244.14/32
   
     197.0.244.15/32, Translated: 100.1.64.40/32, 100.1.95.1/32, 100.1.95.2/32, 100.1.64.30/32
   
     100.1.248.40/32, 100.1.248.20/32, 100.1.248.26/32, 100.1.64.1/32
   
     100.1.64.21/32, 100.1.1.1/32, 100.1.248.17/32, 100.1.95.4/32
   
     100.1.95.5/32
   
  场景七
  对通过防火墙的业务流量，不更改源地址，也就是将源地址NAT自己，我们称为identity NAT。
   
  object network inside-nonat
   
  host 192.168.1.2
   
  nat (inside,outside) static 192.168.1.2
   
  验证：
   
  ciscoasa(config)# show xlate     
   
  1 in use, 17 most used
   
  Flags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twice
   
  NAT from inside:192.168.1.2 to outside:192.168.1.2
   
     flags sI idle 0:02:09 timeout 0:00:00
   
  ciscoasa(config)# show conn
   
  1 in use, 8 most used
   
  TCP outside 100.1.64.1:23 inside 192.168.1.2:65450, idle 0:00:12, bytes 115, flags UIO
   
  ciscoasa(config)# show nat detail
   
  Auto NAT Policies (Section 2)
   
  1 (inside) to (outside) source static inside-nonat 192.168.1.2
   
     translate_hits = 3, untranslate_hits = 0
   
     Source - Origin: 192.168.1.2/32, Translated: 192.168.1.2/32
   
  Router# who
   
     Line      User      Host(s)             Idle      Location
   
  * 0 con 0               idle                00:00:00  
   
    6 vty 0               idle                00:00:07 192.168.1.2
   
  注意：
  Nat-control 不在使用
   
  如果要开启需要使用下面的语法：
   object network obj_any  subnet 0.0.0.0 0.0.0.0
    nat (inside,outside) dynamic obj-0.0.0.0
  object network obj-0.0.0.0
    host 0.0.0.0
  object network obj_any-01
    subnet 0.0.0.0 0.0.0.0
    nat (inside,mgmt) dynamic obj-0.0.0.0
  object network obj_any-02
    subnet 0.0.0.0 0.0.0.0
    nat (inside,dmz) dynamic obj-0.0.0.0
  object network obj_any-03
    subnet 0.0.0.0 0.0.0.0
    nat (mgmt,outside) dynamic obj-0.0.0.0
  object network obj_any-04
    subnet 0.0.0.0 0.0.0.0
    nat (dmz,outside) dynamic obj-0.0.0.0
  object network obj_any-05
    subnet 0.0.0.0 0.0.0.0
    nat (dmz,mgmt) dynamic obj-0.0.0.0
   
  ASA 8.3 后需要使用真实IP 作为ACL 条目.
  ASA 8.3 NAT need real ip address on access-list .Please refer to new migrate on ASA 8.3 NAT commands. For example:
   
  Old Configuration
  static (inside,outside) 172.23.57.1 10.50.50.50 netmask 255.255.255.255
   
  access-list 1 permit ip any host 172.23.57.1
  access-group 1 in interface outside
   
  Migrated Configuration
   
  access-list 1 permit ip any host 10.50.50.50
  access-group 1 in interface outside
  注意事项:
  更新ASA 8.3 NAT 新注意事项 如果做多公网IP 对 一个内网IP的时候SNAT 请大家打开inspect icmp. 切记
   
  常用排错命令：
  show run nat
  show run object-network
  show run object-group
  show nat detail
  show xlate
  show conn
  show nat pool
  debug nat 255