I had to create a rather complex series of NATs on an ASA for a PBX that has 2 IPs (one for RTP and one for Control) but must appear to the ITSP on the internet as one public IP. The client now wants to route some of this traffic via some ISRs where we have ZBF firewalls setup. I have pasted the sections of relevant ASA code (8.3+ NAT version). Will this actually translate to IOS/IOS-XE (have a mix of G2s and 4Ks)? If so how? I've done plenty of 1-1 NATs and some port NAT'ing, but am unsure of the final masking NAT and making it all work together.   Thanks in advance for any assistance! The 1.1.1 ips would be internal and the 2.2.2 would be external. object service SIPRangeUDP service udp source range sip 5090 object service SIPRangeTCP service tcp source range sip 5090 object service RTPRange service udp source range 10020 10531 object network SITENAMEPBX1SIPUDP host 1.1.1.235 object network SITENAMEPBX1SIPUDPOut host 2.2.2.187 object network SITENAMEPBX1SIPTCP host 1.1.1.235 object network SITENAMEPBX1SIPTCPOut host 2.2.2.187 object network SITENAMEPBX1RTP host 1.1.1.236 object network SITENAMEPBX1RTPOut host 2.2.2.187 object network SITENAMEPBXMask host 2.2.2.187 object network SITENAMEPBXMask1 host 1.1.1.235 object network SITENAMEPBXMask2 host 1.1.1.236 object-group network SITENAMEPBXMasking network-object object SITENAMEPBXMask1 network-object object SITENAMEPBXMask2 nat (inside,outside) source static SITENAMEPBX1SIPUDP SITENAMEPBX1SIPUDPOut service SIPRangeUDP SIPRangeUDP nat (inside,outside) source static SITENAMEPBX1SIPTCP SITENAMEPBX1SIPTCPOut service SIPRangeTCP SIPRangeTCP nat (inside,outside) source static SITENAMEPBX1RTP SITENAMEPBX1RTPOut service RTPRange RTPRange nat (inside,outside) source dynamic SITENAMEPBXMasking SITENAMEPBXMask ... View more