CISCO CCNA SECURITY EXAM OBJECTIVES COVERED IN THIS CHAPTER:

• 5.3 Implement NAT on Cisco ASA 9.x
  • Static
  • Dynamic
  • PAT
  • Policy NAT
  • Verify NAT operations
• 5.4 Implement zone-based firewall
  • Zone to zone
  • Self-zone

 Network Address Translation (NAT) is a feature found in firewalls and many router platforms that allows for the translation of private IP addresses to public IP addresses at the network edge. While one of the driving forces behind the development of NAT was the conservation of public IPv4 address space, NAT also has a security component in that the process helps to hide the interior addressing scheme. Zone-based firewalling is an approach that makes traffic filtering decisions between zones rather than by specific IP addresses. In this chapter, you will learn how to implement several types of NAT and configure zone-based firewalling.

In this chapter, you will learn the following:

• How to implement NAT on Cisco ASA 9.x platforms
• How to implement zone-based firewalls

Implementing NAT on ASA 9.x

There are three types of NAT that can be implemented. This section discusses how these three types operate, and you’ll learn how to implement each type on the Adaptive Security Appliance (ASA).

In static NAT, each private IP address is mapped to a public IP address. While this does not save any of the public IPv4 address space, it does have the benefit of hiding your internal network address scheme from the outside world.

In dynamic NAT, a pool of public IP addresses is obtained that is at least equal to the number of private IP addresses that require translation. However, rather than mapping the private IP addresses to the public IP addresses, the NAT device maps the public IP addresses from the pool on a dynamic basis much like a DHCP server does when assigning IP addresses.

Finally, Port Address Translation (PAT) is a form of NAT in which all private IP addresses are mapped to a single public IP address. This provides both benefits of saving the IPv4 address space and hiding the network address scheme. This system is called PAT because the ephemeral port numbers that devices choose as the source port for a connection (which are chosen randomly from the upper ranges of the port numbers) are used to identify each source computer in the network. This is required since all devices are mapped to the same public IP address.

When configuring NAT on the ASA, you need to understand that it uses an object-oriented approach. In other words, an object is created for each host, for each translated address, and for each service that is used in the translation process. Translations are configured as network objects. A network object is defined as a single address or as a network ID.

The resulting host or network defined in a network object is used to represent the private IP address prior to translation. When ACLs are used to define traffic allowed from a lower-security interface to a higher-security interface, these pretranslation objects are referenced.

The ASA uses a NAT table to hold the translations. This table has three sections. When an outgoing packet arrives at the ASA, the sections are read from top to bottom, and the first translation match is applied. The three sections are as follows:

Manual NAT This contains translations that have been defined to be applied by the appliance before the other sections are consulted. These translations are typically very specific and may indicate a translation on both the source and destination IP addresses.

Auto NAT In this section, also called object NAT, translations that are defined on the object itself are contained. These translations, one for each object, are typically either static translations for servers that must be reached from the outside world (and require the same public IP address always) or dynamic translations for clients trying to reach the Internet.

Manual NAT after Auto NAT This contains more general translations not handled by the first two sections. These are used only when no translation matches in the first two sections.

If a packet doesn’t match any of the mappings found in any of the three tables, the packets are sent untranslated.

hostname# show xlate
 
3 in use, 3 most used
PAT Global 103.61.3.9(0) Local 10.1.1.15 ICMP id 340
PAT Global 103.61.3.9(1024) Local 10.1.1.15(1028)
PAT Global 103.61.3.9(1024) Local 10.1.1.15(516)

hostname# show xlate detail
 
3 in use, 3 most used
Flags: D - DNS, d - dump, I - identity, i - inside, n - no random,
       r - portmap, s - static
TCP PAT from inside:10.1.1.15/1026 to outside:103.61.3.9/1024 flags ri
UDP PAT from inside:10.1.1.15/1028 to outside:103.61.3.9/1024 flags ri
ICMP PAT from inside:10.1.1.15/21505 to outside:103.61.3.9/0 flags ri

hostname(config)# show nat
 
NAT policies on Interface inside:
  match ip inside host 192.168.5.6 outside any
    static translation to 128.10.6.2
    translate_hits = 0, untranslate_hits = 0

Configuring Zone-Based Firewalls

Zones are collections of networks reachable over a router interface. Zone pairs are used to define a unidirectional firewall policy. The direction is indicated by specifying the source and destination zones. There is one special type of zone that will be covered in the next section.

When zone-based firewalling is used, each interface (including both physical and virtual interfaces) is assigned to a zone, and a policy is applied to traffic moving between zones. These configurations use a syntax known as the Cisco Common Classification Policy Language. When using the Cisco Common Classification Policy Language, class maps are used to define traffic classes, and policy maps are used to apply policies (actions) to these traffic classes. Finally, service policies are used to activate policy maps on zone pairs.

While only a single service policy can be used on a zone pair, the policy maps within can include multiple class maps. These class maps will be checked for a traffic match in the order in which they are configured. If a match is not found in the first map, the second will be consulted. When there are no matches, the default policy will be applied to the traffic. Figure 14.1 shows this logic.

Moreover, these class maps can be used in more than one service policy. In Figure 14.2 , two class maps have been created, and they have both been used in two different service polices.

Default Policies

When no class map matches the traffic type, the default policy is invoked. This policy’s actions depend on whether the interface has been assigned to a zone and, if so, what policy is currently in effect for that zone pair if it exists. Sound complicated? It can be. Figure 14.3 shows the rules.

Figure 14.3 applies to traffic that is not coming from or destined to the router (self-zone). When that is the case, the rules are as shown in Figure 14.4 .

Understanding the Self-Zone

The self-zone is a special zone that has no interface members. It applies to any traffic destined for the router rather than traffic that the router is routing. An example of this type of traffic would be traffic to manage the device using SSH. It also applies to traffic generated by the router. The traffic going from the router back to the device making the SSH connection to manage the device would be an example of such router-generated traffic.

Summary

In this chapter, you learned about the three forms of NAT: static NAT, dynamic NAT, and PAT. You also learned about the NAT options available in the ASA. You learned about the benefits of NAT and how to configure it and verify its operation. Class maps, policy maps, and service policies and their respective functions in a zone-based firewall were covered as well. Finally, the steps to configure and verify a zone-based firewall ended the chapter.

Exam Essentials

Identify the forms of Network Address Translation (NAT). These include static NAT, dynamic NAT, and Port Address Translation (PAT).

Describe the three sections of the NAT table in the ASA. The Manual NAT section represents translations that have been defined to be applied by the appliance before the other sections are consulted. The Auto NAT section represents translations that are defined on the object itself. The Manual NAT After Auto NAT section contains more general translations not handled by the first two sections.

Identify benefits of policy NAT. In some scenarios, you may need more options than are available with Auto NAT, or you may need to specify exceptions to the Auto NAT rules. By using the Manual NAT section, these options will be available to you. This section also has the advantage of being checked for a translation match before the other two sections.

Verify NAT operations. There are several ways to verify that NAT is operating correctly. They include viewing the NAT translations in the translation table using the show xlate command, and in cases where you are not getting any NAT translations, you can view the configuration and check for errors using the show nat command.

Describe the components of a zone-based firewall configuration. Class maps are used to define traffic classes, and policy maps are used to apply policies (actions) to these traffic classes. Finally, service policies are used to activate policy maps on zone pairs.

List the steps to configure zone-to-zone access. From a high level, to configure zone-to-zone access, the following steps must be performed: 1) define zones, 2) define zone pairs, 3) define class maps that define traffic, 4) define policy maps that apply actions to the class maps, 5) apply policy maps to zone pairs, and 6) assign interfaces to zones.