Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
New Member

help with new NAT config

I'm struggling to get my NAT working as I am upgrading from a PIX to an ASA running 8.4. I'm trying to duplicate the following that was taken from the PIX:

PIX NAT shown here:

nat (inside) 1 0 0

global (outside) 1 interface

global (outside) 1 x.x.x.x

On the ASA, I did the following:

object network obj_any
nat (inside,outside) dynamic interface

And then I added the command below and it overrode my first command

nat (inside,outside) dynamic x.x.x.x

I'm not quite sure how to get it to PAT to the interface, and also use a specific IP for a backup overload. In any case, I tried to remove the last nat that was applied and got this error:

FW(config)# no nat (inside,outside) dynamic x.x.x.x

no nat (inside,outside) dynamic x.x.x.x
ERROR: % Invalid input detected at '^' marker.

I can't seem to remove this NAT. When I try to put my first NAT back in place, I get:

FW(config)# nat (inside,outside) dynamic interface
ERROR: % Invalid input detected at '^' marker.

what am I doing wrong here? If I can't specify both and interface and an ip for the NAT, I can live with that. However, I prefer I use the interface rather than the specific ip if I can only use one. But I can't seem to get it removed. I don't dare use the "clear configure nat" command as I have a whole bunch of static NAT in place that I don't want to have to re-enter.

Hall of Fame Super Silver

Re: help with new NAT config

I believe your inability to use the "no..." command is because you are trying to remove an object NAT rule. You need to enter that command from within the network object configuration mode (as oppposed to the global mode). Reference

So go back into config mode, then enter the command "object network obj_any". You should have a prompt that looks something like:


Then you should be able to do the "no nat... " command.

New Member

Re: help with new NAT config

Thanks for that. I knew it had to be something simple I was missing!

Does anyone know if you can continue to put in a nat statement on the new code that will give me the same as the following does on a PIX?

nat (inside) 1 0 0

global (outside) 1 interface

global (outside) 1 x.x.x.x

Re: help with new NAT config

Yes, You can

It will be

nat (inside,outside) source dynamic any interface


Do rate helpful posts.


Julio Carvajal
Senior Network Security and Core Specialist
New Member

Re: help with new NAT config

I don't understand how that gives me the ability to PAT to the interface as well as a separate IP address, defined as x.x.x.x in my example. As I don't see reference to an IP address in your example, how can your command be provding that?

Hall of Fame Super Silver

Re: help with new NAT config

The examples I have seen usually specify using an address (or address range) for the dynamic NAT with the interface as a PAT fallback. See for example here.

CreatePlease to create content