Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm setting up my first cisco firewalls. A little information first:I have two asa5510 setup in a working active/standby pair.

From my ISP i have two public subnets. A /29 and a /26. On my DMZ interface i have the /26 configured. On my WAN Interface i have configured the /29 IPs. My isp routes the /26 via the /29 primary IP.

I'm running ASA 8.2.

I've turned NAT-Control off, because i don't want to use nat for for other than some internal interfaces. In essence i don't want to use NAT unless i specify it.

I have a internal interface with the network of I've tried setting up nat limke this:

nat (inside) 1 
global (WAN) 1 interface  

I was under the impression that this would let connections that was going from and out the WAN interface to be Port-Address-translated. I'm not getting this to work for some reason.

Inside interface has security level of 100, and wan has security level of 0.

share|improve this question
Yeah, that should work, as long as the traffic doesn't match another NAT rule and passes any ACLs that are applicable on those interfaces. Can you provide the output from a packet-tracer command simulating the traffic? Something like packet-tracer input inside tcp 1024 80 should give some good indication on where the issue is. – Shane Madden Nov 16 '11 at 18:43
I figured it out. I didn't think i needed to add access rules on the WAN_IN because of the lower security level, but apparently I did. – LonelyLonelyNetworkN00b Nov 17 '11 at 16:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.