2

I'm using Cisco ASA 8.2 and am planning to upgrade to 8.4 or later. If you know NAT is totaly redisigned in the newer versions (as of 8.3 and up)

I'm first going to cleanup the excisting rules and have a question about NAT exemption.

nat (apple) 0 access-list nonat_a
access-list nonat_a extended permit ip 10.11.69.0 255.255.255.0 10.10.254.0 255.255.255.0
access-list nonat_a extended permit ip 10.11.69.0 255.255.255.0 10.10.50.0 255.255.255.0
access-list nonat_a extended permit ip 10.11.69.0 255.255.255.0 10.11.71.0 255.255.255.0
access-list nonat_a extended permit ip 10.11.69.0 255.255.255.0 host 10.11.67.11
access-list nonat_a extended permit ip 10.11.69.0 255.255.255.0 host 172.21.53.13
access-list nonat_a extended permit ip 10.11.69.0 255.255.255.0 10.11.65.0 255.255.255.0
access-list nonat_a extended permit ip 10.11.69.0 255.255.255.0 host 172.21.53.22
access-list nonat_a extended permit ip 10.11.69.0 255.255.255.0 10.11.66.0 255.255.255.0
access-list nonat_a extended permit ip 10.11.69.0 255.255.255.0 host 172.21.230.17

when this is my nat excemption configuration, and I don't have got any hits on them

access-list nonat_a; 9 elements; name hash: 0x730fb5b7
access-list nonat_a line 1 extended permit ip 10.11.69.0 255.255.255.0 10.10.254.0 255.255.255.0 (hitcnt=0) 0x55398b19 
access-list nonat_a line 2 extended permit ip 10.11.69.0 255.255.255.0 10.10.50.0 255.255.255.0 (hitcnt=0) 0x973d918e 
access-list nonat_a line 3 extended permit ip 10.11.69.0 255.255.255.0 10.11.71.0 255.255.255.0 (hitcnt=0) 0x8456bc46 
access-list nonat_a line 4 extended permit ip 10.11.69.0 255.255.255.0 host 10.11.67.11 (hitcnt=0) 0x32c44f8d 
access-list nonat_a line 5 extended permit ip 10.11.69.0 255.255.255.0 host 172.21.53.13 (hitcnt=0) 0x718c853b 
access-list nonat_a line 6 extended permit ip 10.11.69.0 255.255.255.0 10.11.65.0 255.255.255.0 (hitcnt=0) 0x2ee8036c 
access-list nonat_a line 7 extended permit ip 10.11.69.0 255.255.255.0 host 172.21.53.22 (hitcnt=0) 0x6fa0837f 
access-list nonat_a line 8 extended permit ip 10.11.69.0 255.255.255.0 10.11.66.0 255.255.255.0 (hitcnt=0) 0xd61e0f54 
access-list nonat_a line 9 extended permit ip 10.11.69.0 255.255.255.0 host 172.21.230.17 (hitcnt=0) 0x5f884523 

May I then conclude that my nat exemptions are not being used? I also niticed that I can't trigger the nat excemption with the build in packettracer. Is that true or should I be aplle to test exemption with the packettrace as well?

Kind regards S

  • 1
    I'd be careful. I've seen acls that don't increment the hitcnt even though I'm watching it work. Do as David said below and check VPNs. It could be a good way to ruin an evening. – coxley Dec 21 '13 at 2:42
  • you see them increment when you use packt trace – Prez Dec 22 '13 at 11:05
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 8 '17 at 15:38
2

The hit count shows how many times traffic was matched to that ACL. Before you remove them though I would look into why they were put in place in the first place. I've seen rules put in place that are used once a year for a couple of days and then not used for a looooong time. The hit count will only show matches since the last clearing of statistics or a reboot. Maybe those rules are used infrequently and haven't incremented for that reason. Just a thought. Perhaps somebody else can provide more insight.

| improve this answer | |
  • thanks. The uptime is almost 2years now. So I believe that if exempt is not ifluencing the ACL's I can safely remove them... – Prez Dec 17 '13 at 22:45
0

Those NAT exempts are for site-to-site(also Remote) tunnels, right? So check your VPN tunnels. Check the ACL for the cryptomaps. I think it is safe to remove statements that are not associated with any VPN.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.