let walk though on your configuration ------------------------------------------------ object network Natted_Hosts subnet 200.10.10.0 255.255.255.0 nat (any,outside) static interface   access-list inside extended permit ip object natted_Hosts any access-group inside in interface inside access-list outside extended permit ip any object Natted_Hosts ---------------------------------------------------------- first your object Natted_Hosts better use dynamic instead of static as you have a subnet behind outside with /24.   access-list inside extended permit ip object natted_Hosts any access-group inside in interface inside this above rule can be seen as a first line of defense, but depends how to play and what protocols you allow or deny. Example now here if the initiator is subnet  200.10.10.0 255.255.255.0 and you want to allow only traffic ssh. you will write it as access-list inside extended permit tcp object natted_Hosts any eq shh access-list inside extended permit deny ip any any access-group inside in interface inside.   now the ASA will narrow down the access at inside instead of doing it at outside. this is also classify as good practice to save your ASA cpu.   access-list outside extended permit ip any object Natted_Hosts packet coming from outside interface is allow access to Natted_Hosts.     in you example (any,outside) with subnet 200.10.10.0 255.255.255.0. will be translated to asa outside ip address.           ... View more

object network natted_Subnet subnet 10.10.10.0 255.255.255.0 nat (any,outside) static interface   long ago i read in cisco documentation nat (any,outside) is not a best practice. would be better if you put tight control on the flow of traffic either from (inside,outside) or (dmz,outside) instead of any,outside.   you better do a dynamic PAT,   object network natted_Subnet subnet 10.10.10.0 255.255.255.0 nat (any,outside) dynamic interface     ... View more

short answer is what you said is correct.         ... View more