How to disable NAT mode on Cisco ASA 9.2 via ASDM 7.2

[nguyenducthang1989]

Dear all,

I'm using ASDM 7.2 to configure ASA 9.2, Now, ASA is running on NAT mode and I don't want to ASA acts as NAT device. But i can not found option "Enable traffic through the firewall without translation" on ASDM. Please guide to help me out this issue.

Best appreciated!

[Karsten Iwen]

The option you are looking for is default in recent ASA releases. Now the ASA behaves more like a router when it comes to NAT:

• If you have a translation rule matching your traffic, the traffic will be translated.
• If there is no rule matching your traffic, no NAT will be performed on the packet.

[johnlloyd_13]

hi karsten,

i recently did a lab on this and thought the connection would 'break.'

but to my surprise the 'newer' image now behaves/routes like a router.

do you have or know a link to support this?  my google search is failing me.

[Karsten Iwen]

I'm not aware of a source where it's clearly stated, but you can read it "between the lines" in the config-guide or the 8.3 Migration Guide.

[Paul Chapman]

The concept of "NAT Control" was removed from the ASA in version 8.3.  See this link.

As Karsten stated, in 8.3 and later you don't have to have a NAT.  If you do create a NAT and you need to exempt traffic, then you need to create NAT exemptions.

In current versions you do need to pay attention to NAT ordering.  If you have a generic PAT configuration (or PAT pool) that covers a range of hosts, then your NAT exemption will only work if it comes before the generic rule.

PSC

[johnlloyd_13]

hi,

thanks! i almost forgot the concept of 'nat control.' +5

guess my mind was stuck  from the concepts in 8.2 when it comes to routing on ASA.

[nguyenducthang1989]

Hi Karrsten,

You mean i need clear all nat rule, after that ASA will not translate the traffic and work as a router?

Should i change name if, security lever priority of inside and outside interface?

At present, my security levers and name if on my asa as below:

interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 10.13.1.254 255.255.255.0 standby 10.13.1.253
!
interface GigabitEthernet0/1
nameif inside
security-level 100
ip address 10.15.1.1 255.255.255.0 standby 10.15.1.253

[Karsten Iwen · Accepted solution]

No more changes needed for nameif or security-levels. Just remove all nat rules and the ASA won't do any translation.