Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

NAT exempt to Internat Interfaces

I am looking for the most efficient way to configure NAT exempt statements for a multiple interface ASA. I know I will need to write ACL's but do I write based on source and destination networks? Or source network to Any? Any suggestions would be greatly appreicated.

3 REPLIES
New Member

Re: NAT exempt to Internat Interfaces

It depends on your network requirements. If you want to exempt the source network to destination network(any) then you can use (example:- internal to any) if you want only source network could access a particular network then exempt destination network instead of any. As per the cisco, the higher zone network can access the lower security zone by default and if you want to give the access to lower zone network to highher zone network then you need access list. Create rule step by step would be in proper way. Thanks

New Member

Re: NAT exempt to Internat Interfaces

Hi,

If you use NAT exemption, and you put from source network to any, your internal network will be able to access internet only through VPN connection. this will put heavy load on the ASA.

regards

New Member

Re: NAT exempt to Internat Interfaces

That is really good to know, I was going to see what would happen with nat0 to any but no need too now.

128
Views
0
Helpful
3
Replies
CreatePlease to create content