Lesson 7

Question 1

Inside end user receives an address from a pool of available addresses

Answer 1

Global (Dynamic) NAT

Question 2

NAT is now built around ______. This allows for IP addresses to be changed and objects to be renamed much easier than previously.

used to define a single item.

Answer 2

objects

Question 3

2 main type of objects

Answer 3

– network - includes hosts, subnets or a range of IP addresses
– service - includes protocols or ports.

Question 4

With V 8.3 NAT behaviour , the security appliance introduces the ____________ , which allows translation policies to be inserted in any arbitrary order .

The rules are processed based on how specific each NAT entry is (top - down manner ) and the first match of the rule stops further rule processing .

Answer 4

Unified NAT table concept

Question 5

can be used to define a single IP address, a range of addresses, a subnet, a network , or an FQDN.

Answer 5

Network objects

Question 6

The host, range, or subnet that is defined by a network object is used to identify the __________, IP address in a NAT configuration.

Answer 6

real or non - translated

Question 7

______is done inside the object and only the source is used as match criteria, it cannot take into consideration the destination of the traffic.

Answer 7

Auto NAT

Question 8

When using Auto NAT, you configure translations as part of the network object definitions . Auto NAT is therefore also sometimes referred to as ___________ .

Answer 8

Network Object NAT

Question 9

__________can be used to configure a single NAT rule that will translate both the source and destination addresses in a packet. This is known also know as _________because NAT can be performed twice, once on the source IP, and once on the destination IP.

Answer 9

Manual NAT

twice NAT

Question 10

NAT translation is ordered in sections of the Unified NAT table as follows:

Answer 10

Section 1 – Manual NAT 
Section 2 – Auto NAT (Object NAT) 
   1 . Static rules 
   2 . Dynamic rules 
Section 3 – Manual NAT (After - Auto)

Question 11

If you need to place a manual NAT rule after Auto NAT, then you can specify the keyword _________ when configuring a Manual NAT rule to place it at the end, in Section 3 .

Answer 11

after - auto

Question 12

If you need to place the Manual NAT rule at a specific location for precedence, then use the ______ argument.

Answer 12

“ line# ”

nat ( real,mapped ) [after - auto] [ line# ] source …

Question 13

________ , or port redirection , is useful when the security appliance needs to statically map multiple inside servers to one global IP address.

Answer 13

Static PAT

Question 14

Dynamic NAT

The first network object identifies the pool of public IP addresses that internal addresses will be translated to.

The second network object (inside) binds the two objects together .

Answer 14

object network OUTSIDE_RANGE
range | host | subnet ip 142.232.199.240 - 142.232.199.250
object network INSIDE_NET
subnet 10.10.101.0 255.255.255.224
nat (inside,outside ) dynamic OUTSIDE_RANGE

Question 15

Dynamic PAT is used when the outside interface IP address or another specified IP address is overloaded

Answer 15

object network INSIDE_NET
subnet 10.10.101.0 255.255.255.224
nat ( inside,outside) dynamic interface

Question 16

Configuring Auto - NAT

Answer 16

object network DMZ_SERVER
host 192.168.2.3
nat ( dmz,outside ) static 142.232.199.45

Question 17

Access list required for lower to higher security

Answer 17

ASA83(config)# access - list OUTSIDE - DMZ permit ip any host 192.168.2.3
ASA83(config )# access - group OUTSIDE - DMZ in interface outside

Question 18

Manual NAT Example

Answer 18

(config)# nat ( inside , outside ) source dynamic REAL - SOURCE MAPPED - SOURCE destination static MAPPED - DEST REAL - DEST

Question 19

nat ( any,outside ) source dynamic any interface

Answer 19

This would enable Dynamic PAT for all users behind the ASA

Question 20

You may deactivate a manual NAT statement by adding the “______ ” keyword at the end of the nat statement.

Answer 20

inactive

Question 21

view a NAT configuration

Answer 21

show run object

show run nat

Question 22

You can see the order of NAT and number of NAT translation hit counts with:

Answer 22

show nat