Cisco Support Community
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

ASA 8.3 and Packet Flow

Packet flow on ASA 8.3 changed ?

In Earlier version 8.2 we used to put permit statment on mapped interface however in OS starting 8.3 access-list entries should have real address .


Lan Server/Real ( )

Outside IP/Mapped ( )

Configured NAT

ASA 0S 8.2 and earlier

access-list outside_in extended permit ip host host

ASA OS 8.3 and later

access-list outside_in extended permit ip host host

In earlier OS packet used to come on outside interface after which ACL was checked , if the ACL permits traffic packets flows further for NAT process

In newer OS packet is coming to outside interface after which NAT is taking place , once the NAT is done mapped ip is changed to real ip and ASA checks for ACL . Dont you think in newer OS CPU will be used much because every packet with is doing NAT while I have blocked all ip and allowed only to access it ?

VIP Purple

ASA 8.3 and Packet Flow

You are right, with the change to the new NAT-model, there was also the change in the ACL that you mention. One benefit of the new model is that you have less to reconfigure if you change your ISP (and you don't have PI-addresses).

The CPU didn't change that much on my ASAs after upgrading from 8.2 to 8.3 and higher.

Don't stop after you've improved your network! Improve the world by lending money to the working poor:

CreatePlease to create content