ASA防火墙新版本8.4-各种NAT场景

原有的语法
nat (inside) 1 0 0
global (outside) 1 10.10.10.100 10.10.10.200
验证
ciscoasa(config)# show nat detail
Auto NAT Policies (Section 2)
1 (inside) to (outside) source static inside-outside-all inside-outside-trans
translate_hits = 0, untranslate_hits = 11
Source - Origin: 200.0.9.10/32, Translated: 10.10.10.3/32
场景六
此环境用户的需求比较复杂，客户在低安全区域有很多提供业务服务的小型机，他需要隐藏被访问的服务器地址，同时要求对外网server的访问进行Static方式一对一的映射。
Object network inside-outside-trans
Range 10.10.10.100 10.10.10.200
Object network inside-outside-PAT
Host 10.10.10.201
Object-group network nat-pat-grp
Topology ：
L100 200.0.9.10 R1 ---.2----192.168.1.0----.1---ASA----.1----10.10.10.0---.2---R2 L100 100.1.64.1
The order of operations works as configured by each section. In order:
TCP PAT from inside:192.168.1.2/18523 to outside:10.10.10.1/18124 flags ri idle 0:00:20 timeout 0:00:30
ciscoasa(config)# show conn
1 inuse, 1 most used
ciscoasa(config)# show conn
1 inuse, 1 most used
TCP outside 100.1.64.1:23 inside 192.168.1.2:33470, idle 0:00:12, bytes 99, flags UIO
场景三
对于有大量公网地址用户，常应用在运营商或者公司内网
ciscoasa(config)# show nat de
ciscoasa(config)# show nat detail
Auto NAT Policies (Section 2)
1 (inside) to (outside) source static inside-server server-static
object network outside-inside-waiguanju-trans69
1 inuse, 1 most used
TCP outside 100.1.64.1:23 inside 192.168.1.2:51245, idle 0:00:07, bytes 100, flags UIO
场景四
对于有大量公网地址用户，常应用在运营商或者公司内网，为防止地址用完可以配置一个PAT和interface (推荐)
Ciscoasa(config)# show xlate
1 inuse, 17 most used
Flags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twice
NAT from inside:200.0.9.10 to outside:10.10.10.3
host 192.168.81.10
nat (inside,outside) static server-static2
原有语法
static (inside,outside) 10.10.10.3 200.0.9.10 netmask 255.255.255.255
验证：
1 inuse, 4 most used
Flags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twice
NAT from inside:0.0.0.0/0 to outside:10.10.10.100/30, 10.10.10.104/29,
ASA防火墙新版本8.4-工程实用手册
注意，现在思科ASA防火墙已经升级到8.4，从8.3开始很多配置都有颠覆性的不同，特别是NAT配置很不一样，使用了object /object-group的新方式
这里为了大家工程实施起来方便，特别总结了如下NAT应用，希望能够帮助大家。
ASA 8.3 NAT 转化新语法：
Subnet 0.0.0.0 0.0.0.0
Nat (inside,outside) dynamic 10.10.10.3
原有的语法
nat (inside) 1 0 0
global (outside) 1 10.10.10.3
验证
ciscoasa(config)# show nat detail
translate_hits = 1, untranslate_hits = 0
Source - Origin: 0.0.0.0/0, Translated: 10.10.10.100-10.10.10.200
ciscoasa(config)# show xlate
TCP PAT from inside:192.168.1.2/33470 to outside:10.10.10.3/46897 flags ri idle 0:00:10 timeout 0:00:30
ICMP PAT from inside:192.168.1.2/33 to outside:10.10.10.3/50079 flags ri idle 0:00:15 timeout 0:00:30
TCP outside 100.1.64.1:23 inside 192.168.1.2:18523, idle 0:00:00, bytes 117, flags UIO
场景二
所有内网流量访问外网时都转换为特定的公网地址，此环境适用于的小型办公室或分支办公室。
Object network inside-outside-all
1. Manual Nat
2. Auto Nat
3. After Auto
Dynamic NAT/PAT场景一：
所有内网流量访问外网时都转换为接口的公网地址，此环境适用于仅有一个公网地址的小型办公室。
Object network inside-outside-all
Subnet 0.0.0.0 0.0.0.0
Nat (inside,outside) dynamic interface
原有的语法
nat (inside) 1 0 0 global (outside) 1 interface
验证：
ciscoasa(config)# show nat detail
Object network inside-outside-trans
Range 10.10.10.100 10.10.10.200
Object ork inside-outside-all
Subnet 0.0.0.0 0.0.0.0
Nat (inside,outside) static inside-outside-trans
Nat (inside,outside) dynamic nat-pat-grp interface
原有的语法
nat (inside) 1 0 0
global (outside) 1 10.10.10.100 10.10.10.200
global (outside) 1 interface
flags s idle 0:13:41 timeout 0:00:00
ciscoasa(config)# show conn
1 inuse, 8 most used
TCP outside 10.10.10.2:57990 inside 200.0.9.10:23, idle 0:00:10, bytes 234, flags UIOB
Auto NAT Policies (Section 2)
1 (inside) to (outside) source dynamic inside-outside-all 10.10.10.3
translate_hits = 3, untranslate_hits = 0
10.10.10.112/28, 10.10.10.128/26, 10.10.10.192/29,
10.10.10.200
flags s idle 0:00:54 timeout 0:00:00
ciscoasa(config)# show conn
Auto NAT Policies (Section 2)
1 (inside) to (outside) source dynamic inside-outside-all interface
translate_hits = 1, untranslate_hits = 0
Source - Origin: 0.0.0.0/0, Translated: 10.10.10.1/24