Cisco Support Community
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

ASA 8.2 to 8.6 Need some help!

We have the asa 5510 v 8.2- We are now migrating to the 5515- I had a few questions in hopes someone out there can help me understand this:

We have a 5515 Sec Plus firewall- Is this the same as the 5515-X? I see nothing in the sh ver that indicates this is a X version. I also see no mention of a non X 5515 firewall. at thsi point I have to assume that the 5515 is inclusive of the " Next-Gen" class. Am I correct?

second:  NAT differences:

From what I knew about NAT in the 8.2 and below ASA, A Global Nat entry like this:

Global (Outside) 1 Interface  would mean NAT anything on the Inside network and PAT it to the IP address of the outside interface. The 1 in there is a reference to the something like a priority or just a simple reference for an ACL??

NAT 0 means its  not to be NAT'd

anything higher than 0 is used as a reference- So my question is this:

If I have a NAT entry like this:

nat (inside) 4 access-list inside_nat_outbound

would this be used in this Global NAT entry: global (outside) 4 xx.xx.xx.xx netmask xx.xx.xx.xx ??

Just trying to get the 2 straight in my head


Community Member

ASA 8.2 to 8.6 Need some help!

ASA 55x5 models are all "X" models (5515X, 5525X, etc).

NAT syntax is COMPLETELY different now in 8.3+ versions. The documentation that I initially used to start learning is

It would be much faster for you to read that than it would be to come up with an understandable explanation for you here, but I'll answer any questions you have after reading it

Hope that helps.

Community Member

ASA 8.2 to 8.6 Need some help!

Thanks. I was merely looking for a explanation of the old global command as I need to fully understand all the Natting that has to happen in the new firewall. Im a new employee walking into this and I see what I think are descrepancies that noone here can I am reaching out to see if I can get help in understanding this a bit more. Has seen a few useful docs, including this one.

IF you look at this:

nat (inside) 1

global (outside) 1

I just want to know for sure that the first line is the ACL that is referenced by 1 (Basically defines the inside source subnet)

I see a Global command like this in my 8.2 FW:

global (outside) 3  netmask

I dont see any acl that is referencing 3 anywhere. Can I assume that its not in use?

Community Member

ASA 8.2 to 8.6 Need some help!

The "3" in "global (outside) 3" doesn't reference an ACL. It's simply an arbitrary number used to group the globals with the nats. It's NOT to be considered a priority, either. The group "1" has no priority over "2".

That's the purpose of the "1" in your example above


nat (inside) 1

global (outside) 1

Means that the local/real IPs from the 'inside' interface translate from to when they are NAT'd to the 'outside' interface.

CreatePlease to create content