ASA 5510 post and pre 8.3 NATting and ACLs

[Adam Hudson]

In the near future I plan on updating all of my firewalls to 8.4, currently we're on a mix of 8.0 and 8.2. I've heard that if your equipment is on 8.2 there's an auto-conversion feature when upgrading to 8.3. However, I do not want to rely on that and am trying my hand at re-writing the NAT and ACLs myself. Attached is my pre 8.3 ASA 5510 config (santized) and a document that shows the particular sections pre 8.3 and what I think they should be after the upgrade.

Can someone take a look and let me know if these look right?

[Karsten Iwen]

I didn't go through your complete config to check it but some hints:

1) for your NAT-Excemption, you can use object-groups. With that you only need one line per interface-combination.

2) There is no nat-control anymore. If there is no nat-command between a particular set of interfaces the packets are just routed between the interfaces.

3) Keep in mind that the new rules are processed top down. By default your global nat-statements come first, then the object-nat.

With that, your config could be more optimized.

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni