How can I find which natted private IP address is communicating on Cisco ASA 5508

Question

Normally we are facing abnormal traffic targeting specific servers. My question is How can I know which private IP address is targeted since we are using Dynamic NAT on Cisco ASA 5508 Firewall?

Regards

Answer 1

I'm not entirely sure if I understand your question, but I believe you want to take a look at the show xlate command.

For example:

myfirewall1/act/pri# show xlate
732 in use, 3000 most used
Flags: D - DNS, e - extended, I - identity, i - dynamic, r - portmap,
       s - static, T - twice, N - net-to-net
NAT from inside:172.16.8.0/24, 172.16.5.0/24, 172.17.60.0/24,
  172.17.10.0/24, 172.17.50.0/24, 172.16.4.0/24,
  172.16.6.0/24, 172.16.7.0/24, 172.17.40.0/24,
  172.17.30.0/24 to outside:172.16.8.0/24, 172.16.5.0/24,
  172.17.60.0/24, 172.17.10.0/24, 172.17.50.0/24,
  172.16.4.0/24, 172.16.6.0/24, 172.16.7.0/24,
  172.17.40.0/24, 172.17.30.0/24
  flags sIT idle 0:00:00 timeout 0:00:00

[output cut...]

TCP PAT from inside:172.16.8.54/53008 to outside:177.36.241.90/53008 flags ri idle 0:32:23 timeout 0:00:30
TCP PAT from inside:172.16.4.52/20592 to outside:177.36.241.90/20592 flags ri idle 0:14:26 timeout 0:00:30
TCP PAT from inside:172.16.6.61/49776 to outside:177.36.241.90/49776 flags ri idle 0:00:16 timeout 0:00:30
TCP PAT from inside:172.16.6.61/63274 to outside:177.36.241.90/63274 flags ri idle 0:53:37 timeout 0:00:30
...
...

You can pipe the output to include to filter on the IP addresses in question:

myfirewall1/act/pri# show xlate | include 172.16.5.56
TCP PAT from inside:172.16.5.56/59970 to outside:177.36.241.72/59970 flags ri idle 0:00:05 timeout 0:00:30
TCP PAT from inside:172.16.5.56/59958 to outside:177.36.241.72/59958 flags ri idle 0:00:29 timeout 0:00:30
TCP PAT from inside:172.16.5.56/59914 to outside:177.36.241.72/59914 flags ri idle 0:00:54 timeout 0:00:30

Or you can narrow the scope with the global, gport, interface, local, lport options.

ncapfw1/act/pri# show xlate ?

  count      Show translation count
  global     Enter this keyword to specify global ip range
  gport      Enter this keyword to specify global port(s)
  interface  Enter this keyword to specify an interface
  local      Enter this keyword to specify local ip range
  lport      Enter this keyword to specify local port(s)
  type       Enter this keyword to specify xlate type
  |          Output modifiers
  <cr>
myfirewall1/act/pri#
myfirewall1/act/pri#    
myfirewall1/act/pri# show xlate global 177.36.241.72
863 in use, 3000 most used
Flags: D - DNS, e - extended, I - identity, i - dynamic, r - portmap,
       s - static, T - twice, N - net-to-net

TCP PAT from inside:172.16.5.61/38464 to outside:177.36.241.72/38464 flags ri idle 0:29:30 timeout 0:00:30
TCP PAT from inside:172.16.5.61/36269 to outside:177.36.241.72/36269 flags ri idle 0:29:30 timeout 0:00:30
TCP PAT from inside:172.16.5.61/57396 to outside:177.36.241.72/57396 flags ri idle 0:29:33 timeout 0:00:30
TCP PAT from inside:172.16.5.61/42706 to outside:177.36.241.72/42706 flags ri idle 0:55:22 timeout 0:00:30
...
...

Hope this helps!

Answer 2

After searching the best way is to use the following command:

Firewall# show local-host connection | i 5.5.5.5

where 5.5.5.5 is the attacker IP

We can also use the following command to see all outside IP addresses communicating with the organization devices:

Firewall# show local-host connection | i outside

still need to now the flag values and the 0 bytes meaning:

bytes 2179, flags UfFRIOB

bytes 0, flags saA

bytes 1095819866, flags UIOB

Answer 3

Generally "show xlate" command display the nat translation . For more visibility check ASA firewall traffic logs to find private IP address translation when dynamic NAT is in use .