question about nat on asa v8.0 with same-security interfaces

Unanswered Question
May 4th, 2012

I want to make sure I understand how the nat requirements work on asa v8.0 when inter-interface is set.  Background:

nat control is off.

same-security-traffic permit inter-interface is on.

"inside" and "MPLS" interfaces are both at security level 100.

"outside" is, of course, as security level 0.

The relevant config looks like this:

interface Ethernet0/0

nameif outside

security-level 0

ip address <public IP>


interface Ethernet0/1

no nameif

security-level 100

no ip address


interface Ethernet0/1.10

vlan 10

nameif inside

security-level 100

ip address

interface Ethernet0/1.20

vlan 20

nameif MPLS

security-level 100

ip address

access-list inside_nat0_outbound extended permit ip any Net-

access-list MPLS_nat0_outbound extended permit ip any Net-

global (outside) 101 interface
nat (inside) 0 access-list inside_nat0_outbound_1
nat (inside) 101 Net-

nat (MPLS) 0 access-list MPLS_nat0_outbound
nat (MPLS) 101 Net-

static (MPLS,outside) <public IP> <MPLS internal IP> netmask
static (inside,outside) <public IP> <inside internal IP> netmask

Am I correct in thinking that traffic will pass between inside (192.168.2.x)  and MPLS (192.168.3.x) in either direction with NO natting, assuming the access-groups assigned to the interfaces permit the traffic?



  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Maykol Rojas Fri, 05/04/2012 - 10:12


Nope, because in your Nat0 is not defined for those two networks, they will end up hitting the egular NAT inside that actually covers it and it will say no translation group found.


mat_rouch Fri, 05/04/2012 - 11:10

I had been under the impression that if there was no nat or static that matched it woul permit the traffic with no natting.

If I add one line:

access-list MPLS_nat0_outbound extended permit ip Net- Net-

Should it work for traffic originating from either inside or MPLS?  Based on my packet-tracer output it appears that it should.



Maykol Rojas Fri, 05/04/2012 - 13:55


You are Totally right, however this Nat rule

nat (inside) 101 Net-

Is a /16 Which will take, will use that NAT and then try to find a global for it. Now, If you add that ACL as part of your NAT0 configuration, that will do the trick.



This Discussion

Related Content