Can an ASA 5525-X dynamically PAT one IP subnet of private addresses (from inside port to outside port) and simultaneously pass another subnet through without PAT?

I have a public IP address on the outside interface and another public IP subnet behind the firewall.

  • outside interface -
  • ISP gateway
  • Private IP - The inside interface connects to another router at That router has:
    • Private interface
    • Public interface

My goal is to dynamically PAT only IP subnet and not IP subnet

interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address

interface GigabitEthernet0/1
 nameif inside
 security-level 100
 ip address 

ASA(config)#object network PUBLIC

ASA(config)#object network PRIVATE

ASA(config)#object network INTERNET

ASA(config)#nat (inside,outside) source dynamic PRIVATE interface

ASA(config)#nat (inside,outside) source static PUBLIC PUBLIC destination static INTERNET INTERNET

Routing between router and asa is simple. I have default route on cisco router forward to inside asa address. And on asa default route forward to ISP address. On other direction on asa I have two static routes forward to public and private ip subnet.

Can something like this work?

  • I must admit that I don't quite understand the problem, but I believe this can be done fairly easily with network objects :)
    – Goodies
    Jan 31, 2015 at 0:46
  • 3
    "can it do X": YES. HOW to do it is not the question you've asked. (and that depends on the version you're running -- old nat vs. new nat syntax. 'tho a 5525-x is almost certainly going to be 8.3+)
    – Ricky
    Jan 31, 2015 at 0:58
  • As @RickyBeam pointed out, the simple answer is "YES", it can. But if you want more help than that, you should give us some example IPs and ask us what you want translated where, and when. I'm sure someone will be able to write out the required syntax.
    – Eddie
    Jan 31, 2015 at 5:26
  • Anyone have an idea ?
    – Bla bla
    Feb 1, 2015 at 13:22
  • I cant believe nobody have an idea for required syntax ?!
    – Bla bla
    Feb 2, 2015 at 23:09

1 Answer 1


You are trying to specify a NO-NAT for your but I don't know why.

Simply having "nat (inside,outside) source dynamic PRIVATE interface" will dynamically PAT your to

Then traffic traversing your inside to outside will not hit the NAT statement therefore pass through without NAT?

Isn't this what you want?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.