Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

ASA5520 v8.2 to v9.1 Dynamic NAT help

I need to allow internal hosts that do not have a public static IP to be able to communicate with internet hosts, ie download software from the Internet

My public address range is

My internal IP address range is

The ASA5520 is on

This is the nat rule I have in an older ASA5510 software version

ASA Version 8.2(1)

global (outside1) 1 interface
nat (Inside1) 1 INT_Net
access-group outside in interface outside1
route outside1 1

I am commissioning an ASA5520 The ASA Version is 9.1(4)

When I run: global (outside1) 1 interface

I am getting
ERROR: This syntax of nat command has been deprecated.

can somebody help me re write this rule.

Hall of Fame Super Blue

ASA5520 v8.2 to v9.1 Dynamic NAT help


You may want to look at the document link at the bottom which gives all the examples of how to configure 8.3 NAT onwards. You can download the pictures section separately and it gives specific examples. When you configure with the new NAT you need to configure it all in one because of the way it groups it together in the configuration.

What i mean by this is that you should not reference your existing INT_Net as it would not be grouped with the rest of the specific NAT configuration.

There are basically two ways to configure what you are trying to do but you should read the document because depending on the other NAT on your ASA you might need to use one or the other ie. section 1 dynamic PAT or section 3 dynamic PAT.

Section 1


object network


nat (inside,outside) dynamic interface

Section 3


object-group network


nat (inside,outside) after-auto source dynamic interface

either may be alright for you but worth reading the document to get an idea of how it all works -


New Member

ASA5520 v8.2 to v9.1 Dynamic NAT help

Thanks for the reply, I tried option 1 to start with and it seems to work ok.

I made a small change as I got an error:


changes to: