Cisco ASA v8 Policy Based NaT

Policy Based NaTing

object network obj-any
subnet 0.0.0.0 0.0.0.0
!
object service obj-icmp
service icmp
!
nat (outside,outside) source dynamic obj-any interface destination obj-any obj-any
service obj-icmp obj-icmp

!
!

So for example we want to NAT our internal (real) addresses to a public (mapped)
address only if they are destined for a particular destination.

We begin by creating our first network object and enter our inside network addresses.

(config)# object network NAT_INSIDE_HOSTS
(config-network-object)#subnet 192.168.1.0 255.255.255.0

We then create a separate network object and specify our public (mapped) address.

(config)# object network NAT_PUBLIC
(config-network-object)#host 10.1.1.1

And then create a third object for our destination hosts our inside users will be accessing.

(config)# object network NAT_PUBLIC_HOSTS
(config-network-object)#host 172.31.1.1

We can now create our NAT rule using the three network objects above.

(config)#nat (inside,outside) source dynamic NAT_INSIDE_HOSTS NAT_PUBLIC
destination static NAT_PUBLIC_HOSTS NAT_PUBLIC_HOSTS

!
!

If we wanted to only NAT our inside hosts to our public address when they were
attempting to access the public hosts above on a specific port we use the second type
of object, the service object like so.

(config)# object service DESTINATION_PORT
(config-network-object)#service tcp destination eq smtp
!
(config)#nat (inside,outside) source dynamic NAT_INSIDE_HOSTS NAT_PUBLIC
destination static NAT_PUBLIC_HOSTS NAT_PUBLIC_HOSTS service
DESTINATION_PORT DESTINATION_PORT

Now your probably wondering why I’ve entered the object group NAT_PUBLIC_HOSTS
twice in each of the NAT rules above, this is due to the behavior of identity NAT,
when entering the NAT command after the ‘destination static’ keywords we are given the
option of specifying a ‘real’ address and a ‘mapped’ address,

which would come in handy if for example we wanted to NAT both the destination and
source addresses of traffic at the same time in one rule.

However for this example and for the majority of real life configuration scenarios you will
want to keep the original destination address as this is likely to be a public address on the
internet and you do this by configuring ‘Identity NAT’ by specifying the same address,

In this case 172.31.1.1, for both the real and mapped addresses, the same applies for the
services,  i.e. source and destination ports as shown in the final NAT rule above.

Traffic Rate Limiting on Cisco ASA 5510

We want to rate limit a local internal host when accessing a specific
external public server. The local host is 192.168.1.10 and the external
public server is 100.100.100.1.

We need to limit the traffic to 100kbps and burst size 8000.

Configuration Snippet :

ASA(config)#access-list rate-limit-acl extended permit ip any any

ASA(config)#class-map rate-limit
ASA(config-cmap)#match access-list rate-limit-acl

ASA(config)#policy-map limit-policy
ASA(config-pmap)#class rate-limit
ASA(config-pmap-c)#police input 2000000 375000
ASA(config-pmap-c)#police output 2000000 375000

Assign to Interface :

ASA(config)#service-policy limit-policy interface outside

IPSEC VPN Redundancy / Failover, over Redundant ISP Links

A) Setup the VPN on the ASA to use primary and secondary ISP links
for VPN redundancy

B) Setup the remote VPN endpoints to use the headend ASA’s primary and
secondary ISP links as VPN peers (whichever is active)

C) Setup ISP redundancy with for example, SLA monitoring

Now given that we are using two interfaces “Primary” and “Secondary”,
we need to mention these as peer Ip addresses on the remote end, as shown below :

crypto map Outside_map 20 match address crypto-acl
crypto map Outside_map 20 set peer 10.10.10.1   20.20.20.1
(Which means, the primary set peer value is 10.10.10.1,
and if is down, device will try for 20.20.20.1 ip address for tunnel)

crypto map Outside_map 20 set transform-set ESP-3DES-MD5

After this, we need to setup pre-shared keys for ip addresses of both primary
and secondary ISP interfaces on the Headend ASA,

Since when a connection is needed to either primary or secondary interface
ip address, we should have a tunnel-group with matching pre-shared key to
complete the ISAKMP negotiation:

tunnel-group 172.16.10.1 type ipsec-l2l
tunnel-group 172.16.10.1 ipsec-attributes
pre-shared-key *

!
!

tunnel-group 172.16.20.1 type ipsec-l2l
tunnel-group 172.16.20.1 ipsec-attributes
pre-shared-key *

interface Ethernet0/0
nameif primary
security-level 0
ip address 172.16.10.1 255.255.255.0
!
interface Ethernet0/1
nameif backup
security-level 0
ip address 172.16.20.1 255.255.255.0
!
!
route primary  0.0.0.0 0.0.0.0 172.16.10.10 1
route backup   0.0.0.0 0.0.0.0 172.16.20.10 254
!
sla monitor 123
type echo protocol ipIcmpEcho 10.0.0.1 interface outside
num-packets 3
frequency 10
!
sla monitor schedule 123 life forever start-time now
!
track 1 rtr 123 reachability

Use-Cases:

===========================================

1. Primary ISP is up and running, with this the VPN will be formed
   with the “Primary” interface, because the SLA monitoring refereed
   under Part 1 above, will put the route,
   “route Primary 0.0.0.0 0.0.0.0 172.16.10.10 1” into effect for routing
   packets, and the “crypto map VPN-map interface Primary”
   will be chosen.
2. If the Primary ISP goes down, then the SLA monitoring will detect that
   the Primary ISP is down and the route
   “route Backup 0.0.0.0 0.0.0.0 172.16.20.10 254” will be chosen.
   With this the “crypto map VPN-map interface Backup” entry will take effect
   because this is the outgoing interface that will be chosen for VPN traffic.
3. If the Primary ISP comes back up now, SLA tracking will detect this
   and the route “route Primary 0.0.0.0 0.0.0.0 172.16.10.10 1” &
   “crypto map VPN-map interface Primary” will be chosen and
   Primary ISP will be chosen for VPN tunnel negotiations.

CISCO ASA SLA Monitor

interface Ethernet0/0
nameif primary
security-level 0
ip address 172.16.10.1 255.255.255.0
!
interface Ethernet0/1
nameif backup
security-level 0
ip address 172.16.20.1 255.255.255.0
!
!
route primary  0.0.0.0 0.0.0.0 172.16.10.10 1
route backup   0.0.0.0 0.0.0.0 172.16.20.10 254
!
sla monitor 123
type echo protocol ipIcmpEcho 10.0.0.1 interface outside
num-packets 3
frequency 10
!
sla monitor schedule 123 life forever start-time now
!
track 1 rtr 123 reachability