Can an ASA 5525-X dynamically PAT one IP subnet of private addresses (from inside port to outside port) and simultaneously pass another subnet through without PAT?

I have a public IP address on the outside interface and another public IP subnet behind the firewall.

  • outside interface -
  • ISP gateway
  • Private IP - The inside interface connects to another router at That router has:
    • Private interface
    • Public interface

My goal is to dynamically PAT only IP subnet and not IP subnet

interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address

interface GigabitEthernet0/1
 nameif inside
 security-level 100
 ip address 

ASA(config)#object network PUBLIC

ASA(config)#object network PRIVATE

ASA(config)#object network INTERNET

ASA(config)#nat (inside,outside) source dynamic PRIVATE interface

ASA(config)#nat (inside,outside) source static PUBLIC PUBLIC destination static INTERNET INTERNET

Routing between router and asa is simple. I have default route on cisco router forward to inside asa address. And on asa default route forward to ISP address. On other direction on asa I have two static routes forward to public and private ip subnet.

Can something like this work?

  • I must admit that I don't quite understand the problem, but I believe this can be done fairly easily with network objects :) – Goodies Jan 31 '15 at 0:46
  • 3
    "can it do X": YES. HOW to do it is not the question you've asked. (and that depends on the version you're running -- old nat vs. new nat syntax. 'tho a 5525-x is almost certainly going to be 8.3+) – Ricky Jan 31 '15 at 0:58
  • As @RickyBeam pointed out, the simple answer is "YES", it can. But if you want more help than that, you should give us some example IPs and ask us what you want translated where, and when. I'm sure someone will be able to write out the required syntax. – Eddie Jan 31 '15 at 5:26
  • Anyone have an idea ? – Bla bla Feb 1 '15 at 13:22
  • I cant believe nobody have an idea for required syntax ?! – Bla bla Feb 2 '15 at 23:09

You are trying to specify a NO-NAT for your but I don't know why.

Simply having "nat (inside,outside) source dynamic PRIVATE interface" will dynamically PAT your to

Then traffic traversing your inside to outside will not hit the NAT statement therefore pass through without NAT?

Isn't this what you want?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.