Testing in a lab...I have a VLAN directly attached to a Cisco ASA 5520 that contains host machines who use IPs from a public address space, for example. The ASA has two interfaces this dmz interface containing the hosts on the and an outside interface containing a /30 peering point to an ASR running BGP etc.

Is there a way to configure the ASA to allow connectivity to and from this without having to put in NAT statements since both interfaces are two different security-levels?

  • dmz security-level 50 (

  • outside security-level 0 ( to ASR

Thanks for everyones help in advance!

1 Answer 1


Disable nat-control. Apply permit acl to outside interface.

  • Hmm, the command errors as it is depreciated, I am running 8.4.2
    – Jim
    Sep 13, 2016 at 20:33
  • After 8.3 there is no nat-control. So you should configure nat exemption. Here is how you can achieve that: object network LOCAL_LAN subnet object network REMOTE_LAN subnet nat (dmz,outside) source static LOCAL_LAN LOCAL_LAN destination static REMOTE_LAN REMOTE_LAN Sep 13, 2016 at 20:47
  • Thank Nuran, that is as far as I got however I can't specify "any" as the REMOTE_LAN?? for example what if it is to, how do I ensure no nat control is happening?
    – Jim
    Sep 14, 2016 at 12:31
  • So apparently i didn't assign my outside ACL to my outside interface via access-group command. I figured it out when I did a packet-tracer and it kept saying it was denied by ACL. Thanks for your help.
    – Jim
    Sep 14, 2016 at 13:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.