Friday, 25 January 2013

Upgrade ASA to 8.4 - The following 'nat' command didn't have a matching 'global' rule on interface and was not migrated - ASA 8.4 (and 8.3) migration

In most cases following warning/error when upgrading to ASA software 8.3 or 8.4 are just informational, and everything went fine. Although you get: NAT migration logs:
The following 'nat' command didn't have a matching 'global' rule on interface 'dmz' and was not migrated.
nat (inside) 1 10.10.10.113 255.255.255.255
And in pre-8.3 configuration you have: NAT migration logs:
global (outside) 1 172.16.1.1 netmask 255.255.255.0
nat (inside) 1 10.10.10.113 255.255.255.255
nat (inside) 1 10.10.10.114 255.255.255.255
nat (inside) 1 10.10.10.115 255.255.255.255
nat (inside) 1 10.10.10.122 255.255.255.255
nat (inside) 1 10.10.10.123 255.255.255.255
nat (inside) 1 10.10.10.124 255.255.255.255
You actually get following entries in 8.3+: NAT migration logs:
object network obj-10.10.10.113-01
 nat (inside,outside) dynamic 172.16.1.1
object network obj-10.10.10.114-01
 nat (inside,outside) dynamic 172.16.1.1
object network obj-10.10.10.115-01
 nat (inside,outside) dynamic 172.16.1.1
object network obj-10.10.10.122-01
 nat (inside,outside) dynamic 172.16.1.1
object network obj-10.10.10.123-01
 nat (inside,outside) dynamic 172.16.1.1
object network obj-10.10.10.124-01
 nat (inside,outside) dynamic 172.16.1.1
So NAT configuration was successfully migrated, and error/warning only means that you didn't have global statement for dmz interface, and only this part of NAT configuration was not migrated. inside-outside part was migrated, and everything is fine.

No comments:

Post a Comment

Disclaimers: This is a personal weblog. The opinions expressed here are entirely my own and not those of my employer and/or its affiliates. This material is not sponsored or endorsed by Cisco Systems, Inc. Cisco, Cisco Systems, CCIE and the CCIE Logo, CCDP, CCNA and CCDA are trademarks of Cisco Systems, Inc. and its affiliates.