Cisco ASA - Delete or rename "names"
I had a bad experience with Cisco ASA when changing/renaming "nameif" interface attributes.
I would like to know if renaming or simply deleting existing names used in ASA config will do any damage to the configuration.
I would like to know if renaming or simply deleting existing names used in ASA config will do any damage to the configuration.
You can safely delete and add
name
aliases because the ASA reverts to the IP address when the name disappears...The original alias is
Xbox
...asa5505(config)# sh runn | i Xbox name 172.16.1.20 Xbox description Xbox access-list INSIDE_in extended permit udp host Xbox any eq domain access-list INSIDE_in extended permit tcp host Xbox any eq domain access-list INSIDE_in extended permit udp host Xbox any eq 3074 access-list INSIDE_in extended permit tcp host Xbox any eq 3074 access-list INSIDE_in extended permit udp host Xbox any eq 88
Now deleting
Xbox
asa5505(config)# no name 172.16.1.20 Xbox asa5505(config)# sh runn | i 172.16.1.20 access-list INSIDE_in extended permit udp host 172.16.1.20 any eq domain access-list INSIDE_in extended permit tcp host 172.16.1.20 any eq domain access-list INSIDE_in extended permit udp host 172.16.1.20 any eq 3074 access-list INSIDE_in extended permit tcp host 172.16.1.20 any eq 3074 access-list INSIDE_in extended permit udp host 172.16.1.20 any eq 88 asa5505(config)#
And adding
Xbox-new
on the same address...asa5505(config)# name 172.16.1.20 XBox-new descr temporary example asa5505(config)# sh runn | i 172.16.1.20 name 172.16.1.20 XBox-new description temporary example asa5505(config)# sh runn | i XBox name 172.16.1.20 XBox-new description temporary example access-list INSIDE_in extended permit udp host XBox-new any eq domain access-list INSIDE_in extended permit tcp host XBox-new any eq domain access-list INSIDE_in extended permit udp host XBox-new any eq 3074 access-list INSIDE_in extended permit tcp host XBox-new any eq 3074 access-list INSIDE_in extended permit udp host XBox-new any eq 88 asa5505(config)#
Bonus material: renaming a
nameif
I had a bad experience with Cisco ASA when changing/renaming "nameif" interface attributes.
Renaming
nameif
on an interface works just fine in ASA 8.2(5)... This is an example of changingnameif OUTSIDE
tonameif newOUTSIDE
asa5505# sh nameif Interface Name Security Vlan100 OUTSIDE 0 Vlan200 INSIDE 100 asa5505# sh runn | i access-group access-group OUTSIDE_in in interface OUTSIDE access-group INSIDE_in in interface INSIDE asa5505# conf t asa5505(config)# int vlan100 asa5505(config-if)# nameif newOUTSIDE asa5505(config-if)# show nameif Interface Name Security Vlan100 newOUTSIDE 0 Vlan200 INSIDE 100 asa5505(config-if)# sh runn | i newOUTSIDE nameif newOUTSIDE mtu newOUTSIDE 1500 global (newOUTSIDE) 1 interface access-group OUTSIDE_in in interface newOUTSIDE ssl trust-point LOCAL_CERT_gw_200904 newOUTSIDE asa5505(config-if)#
The ASA even renamed the interface references from
OUTSIDE
tonewOUTSIDE
automatically... TCP sessions through the FW did not drop when I did it.WARNING
Whatever you do, do not try
no nameif <something here>
... it will hose your config...asa5505(config)# int vlan100 asa5505(config-if)# no nameif OUTSIDE asa5505(config-if)# nameif newBrokenOUTSIDE
Thank you, good to know it. Still I am concern about deleting the names. E.g. names name 10.16.146.10 FTP-Server
One little question: do you happen to know since when this feature was added? I run 8.0.4 on the present device.
According to the ASA 8.0 nameif docs, it works in 8.0 too
License under CC-BY-SA with attribution
Content dated before 7/24/2021 11:53 AM
laf 8 years ago
Thank you, good to know it. Still I am concern about deleting the names. E.g. names name 10.16.146.10 FTP-Server