ASA v8.4 Access from Inside To DMZ

[irfan.ahmed]

Do you require nat to allow  inside network accessing DNZ ip ? I think only ACL is required  in 8.4.

[Philip D'Ath]

NAT is not required, although depending on your software version and options you have need to create a "no-nat" rule.

[irfan.ahmed]

I know with the older version of ASA m NAT is the requirement. Can someone provide details of NAT-Control command. I think with 8.4 we don't need to create NAT rule in order to allow traffic from Higher security level to lower security level ?

[Aditya Ganjoo]

Hi Irfan,

Yes you are correct we do not need to create a NAT for allowing traffic from Higher security level to lower security level.

For more clarity about NAT-control check this:

https://supportforums.cisco.com/document/11936941/lets-briefly-talk-about-what-nat-control

The nat-control command is  deprecated post 8.2. To maintain the requirement that all traffic  from a higher  security interface to a lower security interface be  translated, a NAT  rule will be inserted at the end of section 2 for  each interface to  disallow any remaining traffic. The nat-control command was used for NAT configurations defined with earlier versions of  the adaptive security appliance. The  best practice is to use access  rules for access control instead of  relying on the absence of a NAT rule  to prevent traffic through the  adaptive security appliance.

Regards,

Aditya

Please rate helpful posts and mark correct answers.