its in router mode...

is the nat control disabled by default with this version?

If no nat-control is specified then you do not require NATTing (NAT TRANSLATIONS ARE BYPASSED)

Key Points for No Nat-Control:-

--All traffic leaving a PIX from a higher to lower security interface moves freely

--All traffic entering a PIX from a lower to higher security only requires an ACCESS-LIST

--NAT/GLOBAL pairs are needed only for traffic requiring address translation

For new configurations NAT control is disabled by default, following configuration migration/upgrades NAT-CONTROL is enabled so previous NAT behavior is maintained.

Do Rate If Helps !

thanks for the replies.

but as i said, "no nat control" wasnt specified. is it enabled by default on this version?when i show run, it doesnt show.

i have other version of asa and NAT is in use. when i show run on that box, "nat-control" shows.

By default, NAT control is disabled, so you do not need to perform NAT on any networks unless you choose to perform NAT.

Since its default behaviour, it will no show up in the sh run

thanks a lot.

any documentation for this?

NAT Control:-

The security appliance translates an address when a NAT rule matches the traffic. If no NAT rule matches, processing for the packet "CONTINUES". The EXCEPTION is when you enable NAT control using the nat-control command. NAT control requires that packets traversing from a higher security interface (inside) to a lower security interface (outside) match a NAT rule, or else processing for the packet stops. NAT is not required between same security level interfaces even if you enable NAT control. You can optionally configure NAT if desired.

http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/no.html#wp1737858