topic ASA 5505 Command Line Question in Network Security

ASA 5505 Command Line Question

Tang-Suan Tan — Mon, 11 Mar 2019 21:27:56 GMT

Hi all :

I have a command line from ASA 5505 like below :

nat (inside) 0 access-list NO_NAT

The problem is I cannot see any matching ID of 0 at the (outside) like :

nat (outside) 0 xxxxxxxxxxxxx

Another problem is there is also no any access list with the name of NO_NAT.

Can anybody please help to explain on this? Thanks!

varrao — Wed, 21 Sep 2011 08:56:38 GMT

Hi Tan,

This is Nat-exempt statement, it would not have any matching global id, nat exempt is identified by the nat id 0, the correct usage for it is:

access-list no_nat permit ip 10.0.0.0 255.0.0.0 20.0.0.0 255.0.0.0

nat (inside) 0 access-list no_nat

this means that you are not natting the traffic which is going from 10.0.0.0 to 20.0.0.0.

If you cannot find the access-list, try:

show run access-list NO_NAT

if it does not show anything, then this nat statement is not required, since you do not have an ACL for it.

Hope this helps.

Thanks,

Varun

Please do rate helpful posts.

Tang-Suan Tan — Wed, 21 Sep 2011 09:10:23 GMT

Hi Varun :

Thanks for your answer and explanation.

I now understand what is the meaning on this command line. Appreciate your answer and thanks again.