Network Wizkid's Technical Knowledge Base

In this article, we will take a look at how to configure different types of NAT on the Cisco ASA post 8.4 software code. Accompanying this post is a video demonstration covering what has been discussed in this article. We will cover the following types of NAT: Static NAT Dynamic NAT Dynamic PAT Identity NAT Before jumping into the demonstrations I will explain the purpose of each type of NAT on the Cisco ASA. Overview of NAT NAT addresses can be defined as the following: Inside local address: This is the IP address that is assigned to a host on the inside of a network. The inside local address is most certainly bound to fall within the RFC 1918 reserved private IP address spaces. Inside global address: This is a globally routable IP address (public IP address) that can represent one or more inside local IP addresses to the outside world. Outside local address: This is the IP address of an outside host as it appears to the inside network. Outside global address: This is the IP addre...

In this article I will walk through the steps that are required to configure the ASA for external authentication using Cisco ISE for remote access VPN users. This demonstration will use the following devices: Cisco ISE 2.4 Cisco ASA 9.8 Cisco AnyConnect 4.6 Test Laptop Server 2012 R2 Overview Cisco ISE can be used to authenticate remote access users terminating on a Cisco ASA. Before users gain access to the network, they are required to authenticate using a set of credentials, often certificate-based or by using a username and password. Based on the user authentication, Cisco ISE can be used to determine which tunnel-group the user should be placed within. Change of Authorization (CoA) is supported from ASA version 9.2.1, this allows for ISE to perform things such as posturing. Although not the main focus of this article, Cisco ISE can also be used to apply things such as Dynamic Access Control Lists (dACL’s) based on matched authorization policies. Demonstration Topology In this demo...