Hi,
Both of the configuration formats can achieve the same thing.
The first one is Auto NAT / Network Object NAT where the user configures the whole "nat" configuration under the created "object". Typically this configuration format is used to configure Dynamic PAT , Static NAT and Static PAT atleast.
The second configuration is Twice NAT / Manual NAT which uses different "object" and "object-group" configurations to list the real/mapped addresses in the NAT configurations. This "nat" configuration is not located under any objects but rather uses them. Typically this configuration format is used to configure NAT0 or Policy type NAT configurations.
While both configuration achieve the same thing there is one big difference between them. In the new NAT configuration format that was introduced in 8.3 onwards the NAT configurations are divided into 3 Sections which defines their priority in the "nat" configurations
They go the following way
- Section 1 = Manual NAT / Twice NAT
- Section 2 = Auto NAT / Network Object NAT
- Section 3 = Manual NAT / Twice NAT
- an additional "after-auto" parameter is required to move this configuration to Section 3
So depending on which format you use you might end up overriding some other configuration by inserting the configuration to Section 1 (which you do by using the Manual NAT / Twice NAT configuration format). Though I would say this becomes a problem only in certain situations in simple firewall setups. I'd say the most common problem here on the forums is usually when a user has configured a Dynamic PAT in Section 1 and Static PAT (Port Forward) in Section 2 and uses the same public IP address as the PAT address in both. This creates a situation where all the traffic from external networks matches the Dynamic PAT configuration in the Section 1 rather than any Static PAT configuration in Section 2.
One other big difference between Auto NAT and Manual NAT is the fact that Auto NAT only does translation for the source address (might seem wierd depending on which side you are looking the situation from) while Manual NAT can perform translation for both the source and the destination IP address. But as you are configuring Static NAT this does not really matter. Both NAT formats can achieve the same thing.
In the end nothing is for example stopping you simply from just using Section 1 Manual NAT if you wanted. You could configure any type of NAT you wanted on this section alone and would not have to use Auto NAT at all if that was your wish. But I would say this is not suggestable and even less so if you have a large NAT configuration.
My personal suggestion in short is the following
- Section 1 = Use for NAT0 and Static/Dynamic Policy NAT type configurations as these configurations are usually meant to override any typical NAT configurations.
- Section 2 = Use for Static NAT and Static PAT as this provides the most simple configuration format for the mentioned configurations and they are still high enough in priority being in Section 2. Manual NAT configuration would require multiple "object" configurations to achieve the same.
- Section 3 = Place all your Dynamic NAT/PAT or NAT+PAT configurations here as these should be the last NAT connection should match anyway when there is nothing specific meant for the hosts.
I find that with the above way you both keep your NAT configuration sectioned clearly and know whats where. The configuration is also a bit less cluttered when all configurations are not in the same Section.
If you want to read up some more on the new NAT configuration format you can check a document I wrote here in 2013. Though it contains the things I mentioned above also.
https://supportforums.cisco.com/document/132066/asa-nat-83-nat-operation-and-configuration-format-cli
You can naturally ask more here in this discussion if you want :)
Please do remember to mark a reply as the correct answer if it answered your question.
Hope this helps :)
- Jouni
