- Cisco Employee,
As many ASA administrators are discovering, the Network Address Translation (NAT) configuration style starting with ASA version 8.3 is different from the pre-8.3 style. Admins that have configured NAT on the ASA and PIX platforms for many years will need to become familiar with the new NAT configuration style that the ASA will be using going forward. We've created some guides within the Cisco Support Community to help people get acquainted with the new configurations, and I hope people find them useful, comment on them, and suggest more documents they want to see created.
The motivation for changing the NAT configuration style is in-line with a more fundamental shift of the ASA configuration scheme; a shift to a more object-oriented configuration. And note, I'm not talking about "object-groups" here, but the new "object network" type that can be used to define a host or subnet in the network, and then can act as a container for the NAT configuration to be applied to that host or object. For example, with ASA 8.3, one can define a network object for a new server being brought up in the network behind the ASA's DMZ interface, and in one nat configuration line define how that server will be translated to every interface of the ASA, like this:
ASA(config)# object network smtp_server
ASA(config-network-object)# host 192.168.33.2
With this configuration, users on the outside could send packets destined to 126.96.36.199 -or- 188.8.131.52, and those packets would be forwarded to the dmz interface, with the destination changed to 192.168.99.23. This capability is one that our customers have been wanting for some time, and now the ASA can accomplish it.
For more information on version 8.3, and specifically the new NAT configuration style, please see the links below: