I have an ASA 5505 running 8.4 with its outside interface plugged into our internal network. I want to open up access to hosts on one of the vlans behind that ASA to hosts on our internal network. I was just starting to grasp NAT on our older PIX but the ASA 8.4 has me confused now. Given a clean ASA with an outside vlan of and test vlan of what's the basic configuration needed to allow any hosts on the outside network to have access to any of the hosts on the test network?


Have you already configured the ACLs too? If you've defined your network as outside (default interface security level 0), it will not allow traffic to the other interfaces.

What about your objects - have you defined those? You should really be using object references, rather than IPs when using ASA 8.4.

As far as NAT goes, if you just want to NoNAT everything (everybody keeps their IPs), you would do:

nat (outside,inside) source static myOutsideSubnet myOutsideSubnet IP destination static myInsideSubnet myInsideSubnet

That is the "twice-NAT" method of NAT'ing on 8.4. Sounds weird to you, if you're new to 8.4. Twice-NAT just means that you define two rules for NAT, one in each direction. It is not obvious, but by default, all rules are bidirectional, so the one statement above also created the reverse NAT rule, for traffic going (inside,outside). If you use the ASDM for this, you would see a checkbox for bidirectional when you're creating the NAT, and you would see both rules appear in the console.

There is also object-NAT. Consult the 8.4 docs for syntax and examples of them:



| improve this answer | |
  • Thanks. I did figure this out on my own but it is the correct answer. – fwrawx Nov 12 '12 at 21:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.