Cisco ASA Determine static NAT programmatically?

Question

Is it possible to determine the static nats on an ASA 5550 or 5540 running 8.2(x) programmatically? I don't see it as an available SNMP oid but perhaps I am missing it.

Answer 1

There is probably a more graceful way, but you could write an expect script to login to your ASA and then run the command sh run static, capture the output and then send it somewhere for processing.

I haven't got a full script that will do exactly what you need, as I only use expect to roll out configuration changes across the ASAs I manage. However, the following will login to an ASAs and get to the enable (#) prompt, then dump the config to a tftp server and exit. That does get your config onto a server where you can then process the file(s) using grep.

spawn ssh {user}@{asa-hostname-or-ip-address}
expect -timeout 10
expect "assword:"
send "{password}\r"
expect ">"
send "en\r"
expect "assword:"
send "{password}\r"
expect "#"

# save the running config to the location configured under tftp-server
send "write net\r"
expect "#"

# logout of the ASA
send "exit\r"

Replace {username}, {asa-hostname-or-ip-address}, and {password} above as appropriate.

Someone who is more experienced in expect than me might be able to extract the output of the sh run static command using $expect_out(buffer) and then process it, but the above should get you some of the way.

If doing this on a bunch of ASAs you can put the above into a bash script that pulls in an array of asa hostnames, usernames and passwords, then loop using do.