topic Re: Help required to convert Cisco ASA NAT rule onto Palo Alto in General Topics

Help required to convert Cisco ASA NAT rule onto Palo Alto

kalyanram.piratla — Wed, 22 Feb 2012 10:56:53 GMT

Hi Guys,

I am not expert in reading or understanding the Cisco ASA NAT rules and I have just started to feel comfortable with Palo Alto except for NAT rules. Can someone please guide me through on how to go around configuring the following Cisco ASA NAT rule onto the Palo Alto?

I have just taken a couple of rules to convert. Based on this, I would get the rest done on my own.

Following are the CISCO ASA NAT RULEs:

Rule 1 # access-list inside_nat0_outbound extended permit ip 10.1.2.0 255.255.255.0 10.1.250.128 255.255.255.128

Rule 2 # access-list inside_nat0_outbound extended permit ip EH_Staff_Network 255.255.255.0 10.1.250.128 255.255.255.128

I know the exact rule cannot be expalined, but an overview on how to re-configure the above rules will be very helpful.

Many Thanks in Advance.

Regards,

Kal

Re: Help required to convert Cisco ASA NAT rule onto Palo Alto

gafrol — Wed, 22 Feb 2012 18:39:31 GMT

Hello Kal,

with my limited ASA knowledge I would say your sample code does not look like a NAT rule it looks like an ACL security rule.

This site might be a starting point for you to understand the cisco config:

http://www.tech21century.com/access-lists-and-nat-on-cisco-asa-firewalls-some-clarifications/

rgds Roland

Re: Help required to convert Cisco ASA NAT rule onto Palo Alto

migration — Wed, 22 Feb 2012 19:07:43 GMT

Look to me like that is the ACL that dictates what is allowed to be NAT'd outbound. The actuall NAT rule is setup with the command nat syntax below

xxxx(config)# nat ?

configure mode commands/options:
( Open parenthesis for the name of the network interface where the
hosts/network designated by the local IP address are accessed

Re: Help required to convert Cisco ASA NAT rule onto Palo Alto

kalyanram.piratla — Thu, 23 Feb 2012 13:03:36 GMT

Thank you for the web link. Will look into it, find out more relevant stuff and then come back to you guys.

Cheers Guys.. Very Kind of you.

Regards,

Kal

Re: Help required to convert Cisco ASA NAT rule onto Palo Alto

gafrol — Thu, 23 Feb 2012 13:36:01 GMT

Kal just to let you know if you are not already aware of there is a migration tool.

This tool can migrate a Cisco config to a PA config.

More info http://www.securlabs.net/

rgds Roland

Re: Help required to convert Cisco ASA NAT rule onto Palo Alto

kalyanram.piratla — Thu, 23 Feb 2012 13:44:52 GMT

Roland,

I did know there was a migration tool and it does not convert the NAT rules is what I got to know. Secondly, I am not a CNSE qualified yet so might not have access to the tool is what I got to know. Am I correct? If not is there any way to get it sorted out?

Thank you

Kal

Re: Help required to convert Cisco ASA NAT rule onto Palo Alto

gafrol — Thu, 23 Feb 2012 13:46:16 GMT

Hi Kal,

everybody can use the migration tool just follow this link:

http://www.securlabs.net/

Yes you are right

Doesn't Convert VPN and Nat Rules

rgds Roland

Re: Help required to convert Cisco ASA NAT rule onto Palo Alto

kalyanram.piratla — Thu, 23 Feb 2012 17:00:41 GMT

that is exactly where i was stuck. Unfortunately, I do not feel very comfortable with configuring the NAT rules of PAN even though I understand them theoritically. Hence was asking for help.

Out of the cisco config, I could only find 3 these rules that state NAT: (do they make sense)

nat (inside) 0 access-list inside_nat0_outbound

nat (inside) 1 10.0.0.0 255.0.0.0

nat (dmz) 1 172.16.50.0 255.255.255.0

Re: Help required to convert Cisco ASA NAT rule onto Palo Alto

jhansf5 — Thu, 23 Feb 2012 23:12:53 GMT

Kalyanram,

Here you go...

nat (inside) 0 access-list inside_nat0_outbound

This statement is a no-nat rule. Traffic that arriving on the interface "inside" that matches the ACL "inside_nat0_outbound" is not natted.

nat (inside) 1 10.0.0.0 255.0.0.0

This statement does a hide nat for all traffic arriving on the interface "inside" that comes from 10.0.0.0/8. It will hide it behind the global nat address that corresponds to ID 1, and the correct outgoing interface.

nat (dmz) 1 172.16.50.0 255.255.255.0

This statement (you guessed it!) does a hide nat for all traffic arriving on your "dmz" interface that comes from 172.16.50.0/24. It nats behind the same global statements as the prior rule.

If you post (or PM me) the output of "show run | in global" and "show run | in static", I can explain the rest of the rules for you.

The nat rulebase in your PAN should do the same thing... one rule from inside to outside that does not nat (matching that ACL), and one that does nat (you can create a single rule that handles traffic from both your dmz and inside zones).

HTH,

James

Re: Help required to convert Cisco ASA NAT rule onto Palo Alto

kalyanram.piratla — Fri, 24 Feb 2012 16:20:26 GMT

James,

Thank you for the explanation. I will be going on site to do the migration for the customer. If any thing goes wrong in terms of NAT rules, I will post (or PM you). Thank you once again for your help.

Regards,

Kal

Re: Help required to convert Cisco ASA NAT rule onto Palo Alto

panagent — Tue, 28 Feb 2012 19:31:34 GMT

The www.securlabs.net website is not affiliated with, endorsed or supported by Palo Alto Networks. Use of the site is at your own discretion and risk.

Re: Help required to convert Cisco ASA NAT rule onto Palo Alto

kalyanram.piratla — Thu, 01 Mar 2012 13:45:50 GMT

James,

This installation has been a disaster for me. Just could not understand how the Cisco ASA works in terms of VPN and NAT. Hence, i had to pull back and leave the network as it is.

Re: Help required to convert Cisco ASA NAT rule onto Palo Alto

kalyanram.piratla — Thu, 01 Mar 2012 13:46:49 GMT

Issues I had faced were:

a. We could access the Internet ONLY IF the Proxy settings were enabled on the web-browser ( The settings for proxy were; IP address set to 10.1.30.8 on port 8080). If the proxy settings were disabled, we COULD NOT access the Internet. This meant, all those who were using the proxy settings were able to browse to the internet and administrators who do not use the Proxy, but go through their Cisco ASA were unable to browse to the internet.

b. We were UNABLE to gain access to servers in DMZ ( FYI, on a couple of occasions, we could access the DMZ, strange..!!!).

c. We could NOT send emails, but COULD receive emails.

Re: Help required to convert Cisco ASA NAT rule onto Palo Alto

jhansf5 — Thu, 01 Mar 2012 17:41:46 GMT

I am sorry to hear that.

If you would like some assistance, you can contact me over PM.

Re: Help required to convert Cisco ASA NAT rule onto Palo Alto

migration — Thu, 01 Mar 2012 18:01:48 GMT

Have you tried working with your SE to iron out the rules? Ours has been more than helpful with all of our deployments.

Re: Help required to convert Cisco ASA NAT rule onto Palo Alto

kalyanram.piratla — Mon, 05 Mar 2012 10:16:45 GMT

Prince,

I will be doing it again during this week. Hopefully it goes well.

Re: Help required to convert Cisco ASA NAT rule onto Palo Alto

jseals — Sun, 11 Mar 2012 02:16:25 GMT

Hello,

We have a very good article that goes over the different types of NAT in detail with screenshots of what the security policy and the NAT policy should look like for each:

If you still have trouble, you could contact your SE or support.

Thanks,

Jason