NAT exempt to Internat Interfaces

Unanswered Question
Mar 12th, 2008
User Badges:

I am looking for the most efficient way to configure NAT exempt statements for a multiple interface ASA. I know I will need to write ACL's but do I write based on source and destination networks? Or source network to Any? Any suggestions would be greatly appreicated.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
ray_stone Wed, 03/12/2008 - 22:16
User Badges:

It depends on your network requirements. If you want to exempt the source network to destination network(any) then you can use (example:- internal to any) if you want only source network could access a particular network then exempt destination network instead of any. As per the cisco, the higher zone network can access the lower security zone by default and if you want to give the access to lower zone network to highher zone network then you need access list. Create rule step by step would be in proper way. Thanks

alanajjar Thu, 03/13/2008 - 03:50
User Badges:


If you use NAT exemption, and you put from source network to any, your internal network will be able to access internet only through VPN connection. this will put heavy load on the ASA.


jkeddington_2 Thu, 03/13/2008 - 21:59
User Badges:

That is really good to know, I was going to see what would happen with nat0 to any but no need too now.


This Discussion