To add to Mike's comments:
Given what you stated about having to employ many NAT rules, and having lots of firewall interfaces, I'm assuming that you have two requirements for this NAT setup:
1) Don't translate any traffic that is destined to any internal network, regardless of the interface (this is what required lots of static lines in previous versions)
2) Translate all traffic going out the outside interface using PAT to a particular global IP address
The problem you were facing before is that the object-nat statement you had said "translate all traffic going out the outside interface to the global IP address" and all traffic going out the outside interface hit that rule; If you had other interfaces on this test firewall, traffic would have traversed those interfaces with no problems, and with no translation, like Mike said. A possible approach you could take is this:
object network obj_any
subnet 0.0.0.0 0.0.0.0
!
object network obj-10.0.0.0
subnet 10.0.0.0 255.0.0.0
object network obj-172.16.0.0
subnet 172.16.0.0 255.240.0.0
object network obj-192.168.0.0
subnet 192.168.0.0 255.255.0.0
!
object-group network private-networks
network-object object obj-172.16.0.0
network-object object obj-10.0.0.0
network-object object obj-192.168.0.0
!
nat (any,any) source static private-networks private-networks destination static private-networks private-networks
!
object network obj_any
nat (inside,outside) dynamic interface
This first nat rule "nat (any,any)" makes the firewall NOT translate any traffic sourced from and destined to the private-networks listed in the private-networks object group. You could add subnets to this object group selectively. This rule will match all traffic sent and received between internal subnets, regardless of the interfaces on the firewall that the traffic is traversing. Any traffic that doesn't match rule 1 must be traffic destined to IPs that aren't in your organization, and will fall down and *could* hit rule two:
The second nat rule (the auto nat rule) specifies that any traffic sourced from the inside network, destined to any host on the outside should be translated to the outside interface ip address. You could also make that rule look like this:
object network obj_any
nat (any,outside) dynamic interface
Which would have the effect of ensuring that when any host accessed an IP address on the outside interface that was *NOT* a private address (due to rule #1) the traffic would be translated to the outside interface IP address.
You can use the 'show nat detail' command to view the ordering of the NAT table, and the hits on the translations:
ciscoasa(config)# show nat detail
Manual NAT Policies (Section 1)
1 (any) to (any) source static private-networks private-networks destination static private-networks private-networks
translate_hits = 0, untranslate_hits = 0
Source - Origin: 172.16.0.0/12, 10.0.0.0/8, 192.168.0.0/16, Translated: 172.16.0.0/12, 10.0.0.0/8, 192.168.0.0/16
Destination - Origin: 172.16.0.0/12, 10.0.0.0/8, 192.168.0.0/16, Translated: 172.16.0.0/12, 10.0.0.0/8, 192.168.0.0/16
Auto NAT Policies (Section 2)
1 (inside) to (outside) source dynamic obj_any interface
translate_hits = 0, untranslate_hits = 0
Source - Origin: 0.0.0.0/0, Translated: 14.36.103.9/16
ciscoasa(config)#
