Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Having problems with the NAT RULES and Access Rules changes on my ASA5505. Want to straight replace a 5505 with a newer 5505 and unfortunately this means dealing with old version 7.2 and the newer 8.4 configurations.

my old NAT RULE:

static (inside,outside) WebOutside WebInside netmask

and an Access Rule of:

access-list outside_access_in extended permit tcp any host WebOutside eq www

these dont work in 8.4 I understand there are some changed but I can find little information that makes any sense on how to configure these.

Any pointers welcomed.

share|improve this question
up vote 2 down vote accepted

The NAT syntax has changed in 8.3 and up.

Define the NAT in the host object:

object network WebInside
 ! Inside address:
 ! Outside address:
 nat (inside,outside) static

And your access list needs to change to use the host's post-NAT address.

access-list outside_access_in extended permit tcp any host WebInside eq www

It may be simpler for you to upgrade the code on the old 5505 in order to get the configuration converted before moving to the new device.

share|improve this answer
This is a very good explanation that I could not find anywhere else, thank you very much. – Marko Jun 6 '12 at 8:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.