3

As the topic says, I'm investigating NAT on a clients ASA - it's running old 7.2 train code - I execute 'sh run global' and 'sh run nat' - the latter command only returns a single nat 0 line.

When I do a 'sh run | b static' (which I thought would've shown up under one of the previous two commands!) I get a long list of policy based nat in the format of 'static (outside,inside) x.x.x.x access-list ' Which is what I would expect to have seen from one of those previously attempted commands.

What commands need to be run to see everything involving nat on a 7.2 ASA? I am not seeing any kind of DST nat (which I expect in this particular case) for the tunnel I'm looking at, but yet the tunnel is up and passing traffic, so it's happening somewhere!

Thank you in advance!

3
  • sh run and read the whole output. Firewall configurations can be complex.
    – Ricky
    Apr 8 '15 at 22:01
  • This is a major enterprise edge VPN FW, it's got a massive config so unfortunately that's not an option. I was more or less looking for a comprehensive list of sh X commands to pull everything related to nat quickly - if you have any insight for 7.2 that would be great! Thanks either way for your reply
    – A L
    Apr 8 '15 at 23:36
  • Been there... wr net is the answer. (ie. look at it offline)
    – Ricky
    Apr 9 '15 at 2:14
2

show global
show nat
show static
show conduit (unless you've switched to ACLs)

Of course, that's going to be 90% of the entire configuration anyway. (more if pdm isn't enabled, thus flooding the config with pdm location ...)

4
  • ASA doesn't have pdm, they use asdm. ASA doesn't have conduits either
    – This
    Apr 9 '15 at 7:54
  • v7.2 does, as I recall -- been a long time since I used 7.2 (unsupported, but it will accept the command)
    – Ricky
    Apr 9 '15 at 16:49
  • I know you as someone who values precision and truth, so I'll take your word for it. I did not find pdm commands myself when I searched CCO, but I don't have an ASA that I'm willing to test with
    – This
    Apr 10 '15 at 10:02
  • Marking this as the answer since it more concisely wraps up how to address the aim of seeing all NAT configuration on a device via sh commands. I have only seen mention of conduit on PIX, for reference.
    – A L
    Apr 16 '15 at 8:28
3

'show run static' is a usable show command as well.

1
  • Excellent, between - sh run nat, sh run global, and sh run static I feel like that is every NAT related show command for 7.2. I'm going to leave this open for a few more days in case anyone else has insight, otherwise, I'll mark your answer as correct. Thank you!
    – A L
    Apr 9 '15 at 0:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.