Big changes to access-list creation between PIX 6 and 8?

Unanswered Question
Oct 16th, 2007
User Badges:

Hi everyone,

I have just updated a PIX 525 from software version 6x to 8x.

I have a question on how PDM in version 6x automatically converted access-lists so they worked with outside NAT addresses ? but in version 8x (using ASDM) this is not the case. This is causing me a major headache!

So previously in version 6x:

I created a NAT rule in PDM to translate the internal IP to external:

Inside server IP -

Outside NAT IP -

Resulting in:

static (inside,outside) netmask

I then created a new access rule in PDM to permit traffic from the outside to on the inside for any host.

The resulting access-list visible in the config is:

access-list outside_access_in extended permit ip any host

Note how PDM has taken the inside address I specified and replaced it with the valid outside NAT address. This worked a treat!

Unfortunately in version 8 using with ASDM - if you permit access to an inside address from the outside ? even if a valid (inside,outside) NAT rule is in place ? you get this this in the config:

access-list outside_access_in extended permit ip any host

It seems something major has changed! I have also noticed version 6x created "reference" groups if you allowed access to an inside network "object-group":

For example ? your permit access to an inside group:

object-group network INSIDE-SERVERS




And PDM automatically creates a "reference" (_ref) group that uses the valid outside NAT addresses:

object-group network INSIDE-SERVERS_ref




The group ending in "_ref" is the one used in inbound access-lists.

Version 6 really did work its magic ? has this useful "feature" disappeared in version 8x?

Many thanks for your time,


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)

Something isn't right here. The statement:

static (inside,outside) netmask

is backwards. It should be:

static (inside,outside) netmask

with an accompanying ACL:

access-list outside_access_in extended permit ip any host

I would have to say there is some mis-configuration that is creating these rules backwards.

The _ref thing is a PDM issue in itself.

acomiskey Wed, 10/17/2007 - 06:25
User Badges:
  • Green, 3000 points or more

noran01, are you sure about that? What you said it should be is not correct. I should be...

static (inside,outside) netmask

access-list outside_access_in extended permit ip any host


This Discussion