Cisco ASA - 8.3 / 8.4 NAT Tutorial



ASA 8.3 onwards brings a number of changes in how NAT is processed.
First of all NAT is built around objects, this allows for IP`s to be changed and objects to be renamed much easier then previously.
Also when configuring ACL`s the Real IP/Port address(s) are now used.

Pre 8.3

access-list acl-outside extended permit ip any host

After 8.3+

access-list acl-outside extended permit ip any host

Note : In terms of ports. If you are using port redirection then the real port is defined.

Finally NAT control has been removed.


Unlike object groups, an object is used to define a single item. Objects can then be used within ACL`s, object-groups but most importantly NAT.
There are 2 main type of objects. These are 'network' and 'service'.

  • network - host, subnet or IP range
  • service - protocol/port.


asa(config)# object network obj-server
asa(config-network-object)# host


Show - To show the running configuration objects the command 'show run object' is used.
Rename - To rename an object on the fly the command 'object network VPN-POOL rename RA-POOL' is used.


There are now 2 types of NAT. Auto and Manual NAT.

  • Auto NAT - Only the source is used as a match criteria when NAT`ing.
  • Manual NAT - The source and destination is used as a match criteria when NAT`ing.

Auto NAT

Auto NAT only considers the source address when performing NAT. Based on this Auto NAT is only used for Static or Dynamic NAT.
When configuring Auto NAT is is configured within an object.


Below is an example of a static NAT.

asa(config)# object network obj-server
asa(config-network-object)# host <-- REAL IP
asa(config-network-object)# nat (inside,outside) static <-- MAPPED IP

After configuring this NAT and looking at the configuration we can see the configuration in 2 places ; NAT and object.

asa# show run object
object network obj-server

asa# show run nat
object network obj-server
  nat (inside,outside) static

Manual NAT

Manual NAT considers either only the source or the source and destination address when performing NAT. Manual NAT can be used for (pretty much) all types of NAT i.e NAT exempt, policy NAT etc.

Because Manual NAT can also NAT the source and destination within a single statement it is also known as twice NAT.
Unlike Auto NAT which is configured within an object, Manual NAT is configured directly from the global configuration mode. However only objects are used within the Manual NAT rule rather then IP addresses directly.


Below is an example of static NAT where only the source is considered for NAT. However this is typically done with Auto NAT.

object network obj-server-private
object network obj-server-public

nat (DMZ,outside) source static obj-server-private obj-server-public

Below shows the syntax is we wanted to consider both the source and destination. This method (twice NAT) is also used for NAT exempt (click here for article

nat (real_ifc,mapped_ifc) source static REAL-SRC MAPPED-SRC destination static REAL-DST MAPPED-DST

TIP : I always find the best way to read these statements is from the Real Source. So from the REAL-SRC going out to the REAL-IFC.  To the MAPPED-DST. 

NAT Order

NAT is order within 3 sections.

  • Section 1 – Manual NAT
  • Section 2 – Auto NAT
  • Section 3 – Manual Nat After-Auto

By default only sections 1 and 2 are used. However should you need to place a manual NAT rule after Auto NAT you can specify the keyword after-auto when configuring a Manual NAT rule to place it within Section 3.

nat (real,mapped) [after-auto] [Line#] .........

To view the order of precedence the "show nat" command is used.


Within the AutoNAT / Manual NAT statements there are 3 keywords that are useful to know.

unidirectional - 8.3 Only - This ensured that the NAT statement was unidirectional. There is a caveat for this where it was added the configuration incorrectly when upgrading to 8.3 (CSCti36048).
route-lookup - 8.4(2)+ - This instructs the ASA to use the routing table for the egress interface rather then the interface defined within the NAT statement (i.e 'nat (inside,outside).... rather then use outside the ASA will do a route lookup.)
no-proxy-arp - 8.4(2)+ - This disables proxy arp for the mapped IP address within the relevant NAT statement.

Tags: ASA, TwiceNAT

About the Author


R Donato

Ricky Donato is the Founder and Chief Editor of He currently works as a Principal Network Security Engineer and has a keen interest in automation and the cloud.

You can find Ricky on Twitter @f3lix001