Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am working on converting some PIX rules to ASA 8.6 syntax. Do the following achieve the goal?


  • outside's IP address is
  • The outside IP address I want things translated to is
  • I want to NAT only and on the inside to the outside to be NATed and overload

    nat(inside,outside) source dynamic NAT_INSIDE_OUTSIDE NAT_OUTSIDE_IP_ADDRESS
    object-group network NAT_OUTSIDE_IP_ADDRESS
      network-object host
    object-group network NAT_INSIDE_OUTSIDE

The PIX configureation had something about no_nat. I am not sure what this was about:

 nat (inside) 0 access-list inside_nat0_outbound

This basically contained a list of things that were not NATed out. With the new configuration there is no way to specify this so can I safely assume that things that are not in my NAT_INSIDE_OUTSIDE object group won't be NATed??

share|improve this question
Yes, that looks good. Is it not working? If you had an old configuration that you replaced you might need to issue a "clear xlate" command. – Bad Dos Aug 29 '13 at 20:40
They wern't hooked up, I'm just preconfiguring them. I ran some tests and they appear correct. – oooooo3333 Aug 30 '13 at 20:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.