What are the NAT syntax changes in the Cisco ASA firewall
There are major nat syntax changes after the ASA firewall iOS version 8.3.
Regular static NAT:
In the pre 8.3-
static (inside,outside) 192.168.100.100 10.1.1.6 net mask 255.255.255.255
In the version 8.3 and later-
object network obj-10.1.1.6
host 10.1.1.6
nat (inside,outside) static 192.168.100.100
Regular static PAT:
In the pre 8.3-
static (inside,outside) tcp 192.168.100.100 80 10.1.1.16 8080 netmask 255.255.255.255
In the version 8.3 and later-
object network obj-10.1.1.16
host 10.1.1.16
nat (inside,outside) static 192.168.100.100 service tcp 8080 www
Static Policy NAT:
In the pre 8.3-
access-list NET1 permit ip host 10.1.2.27 10.76.5.0 255.255.255.224
static (inside,outside) 192.168.100.100 access-list NET1
In the version 8.3 and later-
object network obj-10.1.2.27
host 10.1.2.27
object network obj-192.168.100.100
host 192.168.100.100
object network obj-10.76.5.0
subnet 10.76.5.0 255.255.255.224
nat (inside,outside) source static obj-10.1.2.27 obj-192.168.100.100 destination static obj-10.76.5.0 obj-10.76.5.0
Regular Dynamic PAT:
In the pre 8.3-
nat (inside) 1 192.168.1.0 255.255.255.0
nat (dmz) 1 10.1.1.0 255.255.255.0
global (outside) 1 192.168.100.100
In the version 8.3 and later-
object network obj-192.168.1.0
subnet 192.168.1.0 255.255.255.0
nat (inside,outside) dynamic 192.168.100.100
object network obj-10.1.1.0
subnet 10.1.1.0 255.255.255.0
nat (dmz,outside) dynamic 192.168.100.100
NAT & Interface PAT together:
In the pre 8.3-
nat (inside) 1 10.1.2.0 255.255.255.0
global (outside) 1 interface
global (outside) 1 192.168.100.100-192.168.100.200
In the version 8.3 and later-
object network obj-192.168.100.100_192.168.100.200
range 192.168.100.100 192.168.100.200
object network obj-10.1.2.0
subnet 10.1.2.0 255.255.255.0
nat (inside,outside) dynamic obj-192.168.100.100_192.168.100.200 interface