FWSM - NAT: I can't figure this out

Answered Question
Jul 6th, 2009

Hi experts,

I have just been asked to take over management of a FSWM in a 6509. Looking into the config, I notice that there doesn't appear to be adequate NAT statements, as I know them to be.

For example, here is the config relating to a network on the inside interface accessing a device in the web dmz:

interface Vlan351

nameif webfront

security-level 30

ip address

interface Vlan383

nameif inside

security-level 90

ip address

object-group network OFFICE-NETWORKS


access-list INSIDE-IN extended permit ip object-group OFFICE-NETWORKS host

access-group INSIDE-IN in interface inside

route product-inside core12

Now, I would expect there to be a NAT 0 or a static entry, but there are neither (you'll have to trust me on this!). There is actually no NAT 0 entry, only numbers 1-10 for outgoing traffic from the web dmz to the outside interface.

Yet a connection still occurs:

TCP out in idle 0:00:02 Bytes 142 FLAGS - U

And NAT has taken place:

NAT from inside: to webfront: flags Ii

I can't figure out how it knows to NAT this...can anyone shed any light?

Many thanks,


Correct Answer by Jon Marshall about 7 years 7 months ago


nat-control is disabled by default with version 3.1 on the FWSM so i suspect this is why you are seeing the behaviour you describe -


If nat-control was enabled on 3.1 you would see a line in your config - "nat-control"


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Jon Marshall Mon, 07/06/2009 - 05:38


It sounds like you have "no nat-control" enabled on your FWSM. With "no nat-control" enabled traffic can go from a higher to a lower security interface without a NAT rule.

Which version of FWSM code are you running.

Can you see any line in the config to do with "nat-control"


jigsaw2026 Mon, 07/06/2009 - 05:49

Hi Jon,

Many thanks for your response. Apologies, I should have said that I had already searched for no nat-control in the config but it's not there...but thinking about it, does that mean that this is set as default and that's why it's not showing? It's running version 3.1(1).


jigsaw2026 Mon, 07/06/2009 - 06:32

Ah OK, that must be it (although this surprises me!). Many thanks for clearing that up for me :)



This Discussion