IEOC - INE's Online Community

Welcome to INE's Online Community - IEOC - a place for CCIE and CCENT candidates to connect, share, and learn. Our Online Community features CCIE forums and discussions for all tracks including Routing & Switching, Voice, Security, Service Provider, Wireless,, and Storage. Through these online communities you can discuss your questions with thousands of your peers, hundreds of CCIE's and INE's own team of world renowned CCIE instructors and authors, Brian Dennis - Quintuple CCIE #2210, Brian McGahan – Triple CCIE #8593, Petr Lapukhov - Quad CCIE #16379, and Mark Snow - Dual CCIE #14073.
Latest post 10-24-2016 7:14 PM by ciscoskeemz. 2 replies.
Page 1 of 1 (3 items)
Sort Posts: Previous Next
  • 10-17-2016 5:33 PM

    Object vs Object-Groups in NAT

    On the ASA, why would you use object-groups instead of objects when configuring policy NAT. 

    Example. If I create a nat rule that maps to the object, the NAT source type shows in ASDM as Dynamic PAT (Hide), but a NAT rule with the object group shows source as "Dynamic".  Why would they be different? They are both mapping to a single host address. I know I'm missing something really fundamental here


    object network INSIDE_MAPPED_FIRST



    object-group network INSIDE_MAPPED_SECOND

    network-object host



    • Post Points: 20
  • 10-24-2016 5:57 PM In reply to

    Re: Object vs Object-Groups in NAT


       First of all, if you run an ASA Code above 8.3, it means you run the new NAT, which means if you want policy-NAT, you have to configure twice-NAT. With twice-NAT, why would you use objects or objects-groups.......the answer is in the name of those two features:

       - object means a single object, so you can have in this container a subnet, a range, or a single host by the IP or by  FQDN, but you cannot have in there multiple subnets or a subnet and a range defined; a single object is allowed

        - object-groups means a group of objects, so you can have in this container multiple subnets defined, or multiple hosts defined, or a combination of host and subnets.

    So using object-groups gives you flexibility on the policy-NAT configuration.



    Cristian Matei, CCIE #23684 (SC/R&S)

    InternetworkExpert Inc.
    Online Community:
    CCIE Blog:


    • Post Points: 20
  • 10-24-2016 7:14 PM In reply to

    Re: Object vs Object-Groups in NAT

    Hi Cristian,

    Totally understand the benefits of Object groups. I guess what I'm asking is, if you use an Object  (host) as a translated address in ASDM, even if you set it to Dynamic, ASDM will always set it to "Dynamic (Hide)". If you use an Object Group (network-object host) it will stay as "Dynamic"

     Is it because it sees the Object-Group as a PAT Pool?

    • Post Points: 5
Page 1 of 1 (3 items)
IEOC CCIE Forums Internetwork Expert CCIE Training
About IEOC | Terms of Use | RSS | Privacy Policy
© 2010 Internetwork Expert, Inc. All Rights Reserved