IP Address Translation on Cisco ASA Post-9.7: A Modern Approach

With the evolution of Cisco ASA (Adaptive Security Appliance) software post-9.7, network administrators have new, more efficient methods for handling IP address translation. This blog will explore the transition from traditional methods to the modern approach, focusing on how to configure arbitrary IP address translations specifically for traffic from a designated source.

## Traditional Approach

Historically, ASA required specific access control lists (ACLs) to determine which traffic would undergo translation. For example, if you wanted to translate traffic originating from the IP address 1.1.1.1 to a different arbitrary IP, you would set up an ACL to match that source IP and define NAT rules accordingly. Additionally, to block traffic from 4.4.4.4 towards 1.1.1.1, one might think they need to apply inbound ACLs on the DMZ interface, but that wasn't always necessary if proper outbound rules were set.

## Modern ASA Configuration (Post-9.7)

### Key Changes

1. **Unified NAT and ACL Configuration**: In versions after 9.7, Cisco has simplified NAT configuration by integrating it with the access rules. This allows for more streamlined management.

2. **Object-Based Configuration**: The newer ASA versions utilize network objects to define IP addresses and networks, making it easier to manage and apply NAT rules.

3. **Flexibility with NAT Policies**: ASA now supports different types of NAT policies, allowing for more granular control over how and when translations occur.

### Example Configuration

Here’s how you would set up the translation for traffic originating from 1.1.1.1 using the modern approach:

1. **Define Network Objects**:

object network obj-1.1.1.1

  host 1.1.1.1

2. **Define the Arbitrary Translated IP**:

object network obj-translated

  host 10.10.10.10 # The arbitrary IP address for translation

3. **Configure NAT Rule**:

nat (dmz,outside) source static obj-1.1.1.1 obj-translated

4. **Setting Up Access Control**:

While you do not need to explicitly block traffic from 4.4.4.4 in the inbound ACL on the DMZ interface, you can set up rules to permit or deny traffic as required. For example, to ensure that only traffic from 1.1.1.1 is allowed to be translated, you can add:

access-list acl-in extended permit ip host 1.1.1.1 any

access-list acl-in extended deny ip host 4.4.4.4 host 1.1.1.1

access-list acl-in extended permit ip any any # Default permit rule

5. **Applying the ACL**:

Finally, apply the ACL to the relevant interface:

access-group acl-in in interface dmz

## Conclusion

The transition to the post-9.7 configuration of Cisco ASA has made managing IP address translations more intuitive and flexible. By using object-based configurations and unified NAT policies, administrators can efficiently control which traffic is subjected to translation without the complexity of previous ACL requirements. This approach enhances security and streamlines the overall management of network policies. 

Stay updated with Cisco's latest documentation for more advanced features and practices to optimize your network security posture.