ASA 5525X NAT 问题

         先上配置：

DORM-ASA5525# sh run 
: Saved
:
ASA Version 8.6(1)2 
!
hostname DORM-ASA5525
enable password 3Kx6i0ZjebTlNnOn encrypted
passwd uQKhs3FzwvMk3o3b encrypted
names
!
interface GigabitEthernet0/0
 nameif inside
 security-level 100
 ip address 10.137.63.133 255.255.255.224 
!
interface GigabitEthernet0/1
 speed 1000
 duplex full
 nameif outside
 security-level 0
 ip address 1.1.1.1 255.255.255.192 

object-group network Dorm-net
 network-object host 10.175.131.9
 network-object host 10.175.131.10
 network-object host 10.175.131.13
 network-object host 10.175.131.14
 network-object 10.136.0.0 255.255.0.0
 network-object 10.137.0.0 255.255.0.0

object network testlan
 host 10.137.63.211

object network testlan-out
 host 1.1.1.2

nat (inside,outside) source dynamic Dorm-net interface

nat (inside,outside) source static testlan testlan-out 

10.137.63.211 nat 成 1.1.1.2 从内部看不成功，但是从外网登入是正常的，说明静态NAT是成功了的

看转换也是如此

B15-DORM-ASA5525# sh xlate | inc 10.137.63.211
NAT from inside:10.137.63.211 to outside:1.1.1.2
TCP PAT from inside:10.137.63.211/54365 to outside:1.1.1.1/9835 flags ri idle 0:00:36 timeout 0:00:30
TCP PAT from inside:10.137.63.211/54363 to outside:1.1.1.1/8568 flags ri idle 0:00:36 timeout 0:00:30

看nat

B15-DORM-ASA5525# sh nat
Manual NAT Policies (Section 1)

1 (inside) to (outside) source dynamic Dorm-net interface  
    translate_hits = 1305685, untranslate_hits = 218647
2 (inside) to (outside) source static testlan testlan-out  
    translate_hits = 0, untranslate_hits = 61

奇怪吧，一对一的静态NAT居然是在动态PAT的列表后面！！！

服务器出去的NAT源地址转化的是1.1.1.1

为什么会是这样的，这个不符合nat规则啊，cisco的防火墙nat是这样写的:

不管如何，静态NAT都是优先动态NAT的，防火墙BUG吗？

后来我调整了下策略的顺序，因为我发现上面的NAT策略叫法是 Manual NAT Policies (Section 1)

调整完以后的效果

1 (inside) to (outside) source static testlan testlan-out  
    translate_hits = 11, untranslate_hits = 4484
2 (inside) to (outside) source dynamic Dorm-net interface  
    translate_hits = 184648, untranslate_hits = 40316
3 (campus) to (outside) source dynamic netMGT out2  
    translate_hits = 422398, untranslate_hits = 4333

总结：

nat (inside,outside) source static testlan testlan-out        /*   这种写法就是手动NAT策略  */

object network testlan 
 nat (inside,outside) static testlan-out                 /*  这种做法就是自动的NAT策略  */ 

手动的要手动设置列表顺序，自动的才是按照NAT的规则排序。

所以写这种下面NAT的时候最好加上序号

B15-DORM-ASA5525(config)# nat (inside,outside) ?

configure mode commands/options:
  <1-2147483647>  Position of NAT rule within before auto section
  after-auto      Insert NAT rule after auto section
  source          Source NAT parameters