1

I'm setting up a site-to-site via ASDM. Initially I configured both devices correctly, matching policies, crypto, etc and set both inside networks as "NAT exempt". Problem is, when I apply changes on older device (ASA8) I get error which I think is usually related to the ASA not understanding the command :

[OK] object network NETWORK_OBJ_10.10.50.0_23
      object network NETWORK_OBJ_10.10.50.0_23
[ERROR] subnet 10.10.50.0 255.255.254.0

subnet 10.10.50.0 255.255.254.0
  ^
ERROR: % Invalid input detected at '^' marker.

[OK] object network NETWORK_OBJ_10.10.60.0_23
      object network NETWORK_OBJ_10.10.60.0_23
[ERROR] subnet 10.10.60.0 255.255.254.0

subnet 10.10.60.0 255.255.254.0
  ^
ERROR: % Invalid input detected at '^' marker.

[ERROR] nat (inside,outside) 1 source static NETWORK_OBJ_10.10.60.0_23 NETWORK_OBJ_10.10.60.0_23 destination static NETWORK_OBJ_10.10.50.0_23 NETWORK_OBJ_10.10.50.0_23

nat (inside,outside) 1 source static NETWORK_OBJ_10.10.60.0_23 NETWORK_OBJ_10.10           ^.60.0_23 destination static NETWORK_OBJ_10.10.50.0_23 NETWORK_OBJ_10.10.50.0_23

ERROR: % Invalid input detected at '^' marker.

Any ideas?

Specifically, this occurs when trying to enable "NAT Exempt" status on VPN profile of older ASA. The VPN shows ACTIVE and I can ping router LAN IP, but I can't hit remote LAN beyond (ie: 10.10.50.1 = SUCCESS, 10.10.50.6 = FAIL)

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Feb 24 '18 at 20:39
1

There is a difference in syntax how NAT is configured on pre ASA v8.3 and newer versions. Please see examples below, or just use older version of ASDM matching your software on ASA. enter image description here

enter image description here

  • okay, I got nat configured correct but when I map the crypto policy it kills another Dynamic VPN that's been set up. Is it possible to set up a dynamic and a static tunnel on the same interface? – mlxs Feb 22 '18 at 2:06
0

Turns out it was because a previous/incomplete S2S had been setup using same objects. Removed them and re-added using info from datagram-network. Next step: upgraded these severely outdated machines =)

Thanks!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.