03-12-2008 10:11 PM - edited 03-11-2019 05:16 AM
I am looking for the most efficient way to configure NAT exempt statements for a multiple interface ASA. I know I will need to write ACL's but do I write based on source and destination networks? Or source network to Any? Any suggestions would be greatly appreicated.
03-12-2008 10:16 PM
It depends on your network requirements. If you want to exempt the source network to destination network(any) then you can use (example:- internal to any) if you want only source network could access a particular network then exempt destination network instead of any. As per the cisco, the higher zone network can access the lower security zone by default and if you want to give the access to lower zone network to highher zone network then you need access list. Create rule step by step would be in proper way. Thanks
03-13-2008 03:50 AM
Hi,
If you use NAT exemption, and you put from source network to any, your internal network will be able to access internet only through VPN connection. this will put heavy load on the ASA.
regards
03-13-2008 09:59 PM
That is really good to know, I was going to see what would happen with nat0 to any but no need too now.
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: