Hi,
I personally always use "object-group" to define the source addresses for the basic PAT/NAT configurations. Pretty much for the reason you have already stated. The NAT configuration is easier to manage and we create a lot less configurations.
Though I would do a minor change to the NAT configuration you mentioned first.
I would add the "after-auto" parameter to the NAT configuration. This would move the NAT rule to Section 3 instead of Section 1 (where it would go without the "after-auto" parameter)
nat (inside,outside) after-auto source dynamic GRP_OBJECT_INSIDE_NETS interface
Being in Section 3 of the NAT rules it would be one of the last NAT rules to be matched against connections coming through the ASA. And I would consider this natural as we are configuring a Default PAT rule to which any connection should hit IF it did not have a more specific rule.
If the NAT configuration you mention was inserted in the format in the original post, it might potentially override any other translations for those "inside" networks towards "outside" networks.
The second way you mention doing the same uses Network Object NAT, which is an Section 2 NAT. I see it used in simple network setups but personally I would only suggest it to be used with Static NAT and Static PAT.
The Section 2 Network Object NAT operates a bit like the old NAT format. It gives higher priority to "static" configurations instead of "dynamic". Inside those mentioned types it again prefers to the more specific number of source address. In the end it might even match on the basis of how the "object" is named. In other words look at the alphabetical order of the name of the configured "object" for the NAT.
But as I said before, I prefer to leave Network Object NAT only for Static NAT and Static PAT. Section 1 NAT I use for NAT0 / Identity NAT / Policy NAT / Policy PAT configurations usually. And Section 3 I use for the Default PAT / NAT rules.
If you want to read some more about the subject I could suggest a document I created on the forums.
https://supportforums.cisco.com/docs/DOC-31116
Naturally you can ask more on these forums.
Please remember to rate helpfull answers and mark questions as answered if they did.
- Jouni
