****
https://www.practicalnetworking.net/stand-alone/cisco-asa-nat/Part 1 – NAT Syntax
There are two sets of syntax available for configuring address translation on a Cisco ASA. These two methods are referred to as Auto NAT and Manual NAT. The syntax for both makes use of a construct known as an object. The configuration of objects involve the keywords real and mapped. In Part 1 of this article we will discuss all five of these terms.
Objects
An object is a construct which represents any single item in your network environment. Two types of objects can be configured:
a network object — represents one IP address, or one IP Subnet, or one IP address range
a service object — represents one set of a Protocol, Source Port, and/or Destination port
The idea is to configure and define an object, then reference that one item in your configuration by the object’s name.
Network Objects
To configure a network object, first use the following syntax to create the object:
object network <Object Name>
Then define the content of the object as either a single IP Address, or a single IP Subnet, or a single IP Address range using either of the commands below:
host <IP Address>
subnet <Network ID> <Subnet Mask>
range <Start IP Address> <End IP Address>
Below are examples of each of the three types of network objects:
To create a network object which represents your web server’s IP address, you would use the following syntax:
object network WEB-SERVER
host 172.16.30.15
To create a network object which represents your Inside network, you would use the following syntax:
object network INSIDE-NETWORK
subnet 172.16.30.0 255.255.255.0
Lastly, to create a network object which represents a particular IP address range, you would use the following syntax. This will define a range that includes all five IP addresses in the inclusive range of 72.6.6.10 through 72.6.6.14.
object network PUBLIC-IPs
range 72.6.6.10 72.6.6.14
Service Objects
To configure a service object, first use the following syntax to create the object:
object service <Object Name>
The content of the service object must include at least a protocol, and can also include a source port, destination port, or both. Here are examples of all four possibilities:
object service PROTOCOL
service esp
object service PROT-DST
service tcp destination eq 80
object service PROT-SRC
service tcp source gt 1023
object service PROT-SRC-DST
service udp source eq 53 destination eq 53
The specific port number the object represents can be identified using certain operators – the example above uses eq and gt. Five different operators exists:
eq <Port#> Port must be equal to <Port#>
gt <Port#> Port must be greater than <Port#> (equal to <Port#> will not match)
lt <Port#> Port must be lesser than <Port#> (equal to <Port#> will not match)
neq <Port#> Port must be not equal to <Port#>
range <Start#> <End#> Port must be in the inclusive range of <Start#> to <End#>
Viewing Objects
Two commands are available to view objects:
The show run object command lists the objects essentially as they were configured above:
asa98# show run object
object service PROTOCOL
service esp
object service PROT-DST
service tcp destination eq www
object service PROT-SRC
service tcp source gt 1023
object service PROT-SRC-DST
service udp source eq domain destination eq domain
object network WEB-SERVER
host 172.16.30.15
object network INSIDE-NETWORK
subnet 172.16.30.0 255.255.255.0
object network PUBLIC-IPs
range 72.6.6.10 72.6.6.14
And the show run object in-line command displays the same as above, except every object definition will be on the same line as the object name:
asa98# show run object in-line
object service PROTOCOL service esp
object service PROT-DST service tcp destination eq www
object service PROT-SRC service tcp source gt 1023
object service PROT-SRC-DST service udp source eq domain destination eq domain
object network WEB-SERVER host 172.16.30.15
object network INSIDE-NETWORK subnet 172.16.30.0 255.255.255.0
object network PUBLIC-IPs range 72.6.6.10 72.6.6.14
Using the in-line variant makes it much easier to “pipe include” and search for a specific object name and/or definition:
asa98# show run object in-line | include WEB
object network WEB-SERVER host 172.16.30.15
If you had done the “pipe include” without the in-line option you just would have received the full name of the object, but not the object’s definition.
Recent Posts