Placing NAT statements in sections

[robert.mcclain]

is there a rule of thumb or general guildline for where you place these NAT statements?

I see 3 sections and after reading some posts I see a lot of "after-auto", which places the NAT statement in section 3.

I read the part in this document (http://www.cisco.com/en/US/partner/docs/security/asa/asa84/configuration/guide/nat_overview.html#wp1118157)

on the rule order, but I am still unclear.

[Jouni Forss · Accepted solution]

Hi,

I would suggest reading a document I wrote here on the forums on the "Documents" section.

https://supportforums.cisco.com/docs/DOC-31116

It explain for example the NAT rule ordering and the way I use the different Sections.

In general I would place the typical different types of NAT in the following way

Section 1

• NAT0 / NAT Exempt
• Policy type NAT configurations
• Any other special/uncommon NAT configurations

Section 2

• Static NAT
• Static PAT

Section 3

• Default Dynamic PAT/NAT rules means for majority of the users. The last section is the natural place for them as this rule should be the "last resort" for basic traffic through the firewall.

Hope this helps

Remember to mark the reply as the correct answer if it answered your question.

Naturally ask more here in this discussion if you want some more specific answers than the document provides.

- Jouni

[robert.mcclain]

Thanks for the answer and the link, reading it now.