Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Attention: The Cisco Support Community site will be in read only mode on Dec14, 2017 from 12:01am PST to 11:30am for standard maintenance. Sorry for the inconvenience.

New Member

Nating Issue on ASA

Hi Guys,

I have pix firewall 525 with software V 6.3. In that pix firewall, i can able to access the one of the dmz server using both nated ip( let say and the original DMZ IP (let say Recently i tried to upgrade to ASA with version 8.0. after the upgrade i can access only via nated ip ( the nating enabled not able to access the dmz ip( I didn't upgrade due to this issue as some of my testers use the original dmz ip. I setup the test lab to try it out. the following shows the config. The problem is i cannot access original DMZ IP in asa V 7.2 onwards once Nating is enabled but with the same config i can access both the IP's in PIX V 6.3 while the nating is enabled. Is there any new features blocking it. what's the reason for not able to access the original dmz ip while static NAT is enabled for the DMZ Server from the inside interface.Pls advise.Thanks.

Test Lab Config :

ASA Version 8.0(2)


hostname ciscoasa

enable password 9jNfZuG3TC5tCVH0 encrypted



interface Ethernet0/0

nameif outside

security-level 0

ip address


interface Ethernet0/1

nameif dmz

security-level 10

ip address


interface Ethernet0/2

nameif inside

security-level 100

ip address


interface Ethernet0/3


no nameif

no security-level

no ip address


interface Management0/0


no nameif

no security-level

no ip address



passwd 2KFQnbNIdI.2KYOU encrypted

ftp mode passive

access-list inside extended permit ip any any

access-list outside extended permit ip any any

access-list dmz extended permit ip any any

pager lines 24

mtu outside 1500

mtu dmz 1500

mtu inside 1500

no failover

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

static (dmz,outside) netmask

static (dmz,inside) netmask

access-group outside in interface outside

access-group dmz in interface dmz

access-group inside in interface inside

route outside 1

route inside 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout uauth 0:05:00 absolute

dynamic-access-policy-record DfltAccessPolicy

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

no crypto isakmp nat-traversal

telnet timeout 5

ssh timeout 5

console timeout 0

threat-detection basic-threat

threat-detection statistics access-list


class-map inspection_default

match default-inspection-traffic



policy-map type inspect dns preset_dns_map


message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp


service-policy global_policy global

prompt hostname context


: end



Re: Nating Issue on ASA

It sounds like you may have had DNS doctoring in the PIX. In the ASA you can setup bidirectional NAT explained in the following link.

Hope that helps.

CreatePlease to create content