Best way to do multiple NAT statements on ASA

| I have 3 DMZs and an inside network. | | Inside network is 192.168.1.0/24, DMZ1 is 192.168.2.0/24, DMZ2 is | 3.0/24, and DMZ 3 is 4.0/24. | | I want all networks to be able to talk to each other without NAT | (there will be ACLs however). | | Currently I have NAT statements like this:

| However, what is the most efficient way to get all the DMZs talking to | each other without NAT? Do I have to use commands like: | Is there a more efficient or secure way?

You can disable the nat control feature. The command is: no nat-control After this you don't need to have nat statements for traffic that goes from one interface to another.

The best way is to use no nat-control command, so that firewall doesn't require NAT between network segments. However, if you need to use NAT from your LAN to the Internet for example then you must (despite 'no nat-control') apply NAT /identity NAT / NAT exception rule to that traffic going to any lower security level interfaces. So, in your case it's best to use nat 0 (nat exception) for traffic flowing between your network segments. I think that you even can try to use same security level for all DMZs to avoid need for NAT, but I'm not sure about it, but doing that you loose ASA's ability to filter traffic without configuring giant access-lists.

Igor