Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Webcast-Catalyst9k
New Member

ASA 8.3(1) nat exemption for L2l VPN

                   Hello Expert,

I hve a cisco asa running 8.3(1) version.

I have a succesffull L2L tunnel between two sites. but, im confused about the nat exemption used here. An acl is defined stating the interesting traffic of two sites using the tunnel should be nat exempted and is configured as below in rectangular boxes.

The ACL created doesnt have a statement to be nat exempted nor it is applied to any interface.

nat (inside) 0 access-list inside_nat0_outbound

## Configure NAT Exempt ACL

access-list inside_nat0_outbound extended permit ip object-group ET_LOCAL object-group ET_REMOTE

object-group network ET_LOCAL

network-object host 10.x.x.x

object-group network ETS_REMOTE

network-object host 64.x.x.x

1 ACCEPTED SOLUTION

Accepted Solutions
Purple

ASA 8.3(1) nat exemption for L2l VPN

Hi,

These is a relic of pre 8.3 because as I said this is old syntax so I assume you migrated your config to 8.3 and this is leftover, if this is the case then you can safely delete it.Maybe as a safeguard making the ACLs inactive and verify tunnels are ok then you can delete them.

Regards

Alain

Don't forget to rate helpful posts.

Don't forget to rate helpful posts.
3 REPLIES
Purple

ASA 8.3(1) nat exemption for L2l VPN

Hi,

The syntax with the ACL and NAT 0 is pre-8.3 syntax.

For post-8.2, the syntax should be:

nat(inside,outside) source static ET_LOCAL ET_LOCAL destination static ETS_REMOTE  ETS_REMOTE

Regards

Alain

Don't forget to rate helpful posts.

Don't forget to rate helpful posts.
New Member

ASA 8.3(1) nat exemption for L2l VPN

Hi alain,

Thanks for the response.

So, what is the purpose of ACL (inside_nat0_outbound) for nat exemption configured even for other tunnels in our Firewall though the hitcount of that ACL is Zero. If this doesnt make any sense shall i remnove as only needed syntax is Nat(inside, outside) source static as you configured above?

Purple

ASA 8.3(1) nat exemption for L2l VPN

Hi,

These is a relic of pre 8.3 because as I said this is old syntax so I assume you migrated your config to 8.3 and this is leftover, if this is the case then you can safely delete it.Maybe as a safeguard making the ACLs inactive and verify tunnels are ok then you can delete them.

Regards

Alain

Don't forget to rate helpful posts.

Don't forget to rate helpful posts.
390
Views
0
Helpful
3
Replies
CreatePlease to create content