3

As the topic says, I'm investigating NAT on a clients ASA - it's running old 7.2 train code - I execute 'sh run global' and 'sh run nat' - the latter command only returns a single nat 0 line.

When I do a 'sh run | b static' (which I thought would've shown up under one of the previous two commands!) I get a long list of policy based nat in the format of 'static (outside,inside) x.x.x.x access-list ' Which is what I would expect to have seen from one of those previously attempted commands.

What commands need to be run to see everything involving nat on a 7.2 ASA? I am not seeing any kind of DST nat (which I expect in this particular case) for the tunnel I'm looking at, but yet the tunnel is up and passing traffic, so it's happening somewhere!

Thank you in advance!

Improve this question
3
  • sh run and read the whole output. Firewall configurations can be complex.
    – Ricky
    Apr 8, 2015 at 22:01
  • This is a major enterprise edge VPN FW, it's got a massive config so unfortunately that's not an option. I was more or less looking for a comprehensive list of sh X commands to pull everything related to nat quickly - if you have any insight for 7.2 that would be great! Thanks either way for your reply
    – A L
    Apr 8, 2015 at 23:36
  • Been there... wr net is the answer. (ie. look at it offline)
    – Ricky
    Apr 9, 2015 at 2:14

2 Answers 2

Reset to default
2

show global
show nat
show static
show conduit (unless you've switched to ACLs)

Of course, that's going to be 90% of the entire configuration anyway. (more if pdm isn't enabled, thus flooding the config with pdm location ...)

Improve this answer
4
  • ASA doesn't have pdm, they use asdm. ASA doesn't have conduits either
    – Mike Pennington
    Apr 9, 2015 at 7:54
  • v7.2 does, as I recall -- been a long time since I used 7.2 (unsupported, but it will accept the command)
    – Ricky
    Apr 9, 2015 at 16:49
  • I know you as someone who values precision and truth, so I'll take your word for it. I did not find pdm commands myself when I searched CCO, but I don't have an ASA that I'm willing to test with
    – Mike Pennington
    Apr 10, 2015 at 10:02
  • Marking this as the answer since it more concisely wraps up how to address the aim of seeing all NAT configuration on a device via sh commands. I have only seen mention of conduit on PIX, for reference.
    – A L
    Apr 16, 2015 at 8:28
3

'show run static' is a usable show command as well.

Improve this answer
1
  • Excellent, between - sh run nat, sh run global, and sh run static I feel like that is every NAT related show command for 7.2. I'm going to leave this open for a few more days in case anyone else has insight, otherwise, I'll mark your answer as correct. Thank you!
    – A L
    Apr 9, 2015 at 0:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.