Many times this has been a sticking point for ASA code upgrades, but the time is coming where the 8.3 code update is going to be a requirement (as I have found with the AIP modules).

&nbsp;

HUGE reminder that the upgrade from 8.2 to 8.3 is not an easy or simple upgrade.

&nbsp;

There is also no skipping ahead.  You have to go from 8.2 to 8.3, you can't jump over 8.2, you have to upgrade to 8.2 first if you aren't already there.

&nbsp;

There are a lot of changes to the code, but none as noticeable as the new NAT statements.

&nbsp;

Another big reminder is to disable nat-control BEFORE you perform the upgrade.  This is the feature that made it so that you had to configure NAT statements between the different interfaces.

&nbsp;

Below is a chart comparing the configuration steps from 8.2 to 8.3 for NAT statements.

&nbsp;
<table cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td valign="middle"><strong>NAT Feature</strong></td>
<td valign="middle"><strong>pre-8.3 Configuration</strong></td>
<td valign="middle"><strong>8.3 Configuration</strong></td>
</tr>
<tr>
<td valign="middle">Static NAT</td>
<td valign="middle">static (inside,outside) 209.165.201.15 10.1.1.6 netmask 255.255.255.255</td>
<td valign="middle"><strong>Option 1 (Preferred)</strong>object network obj-10.1.1.6host 10.1.1.6

nat (inside,outside) static 209.165.201.15

&nbsp;

<strong>Option 2
</strong>

object network server_real

host 10.1.1.6

object network server_global

host 209.165.201.15

!

nat (inside,outside) source static server_real server_global</td>
</tr>
<tr>
<td valign="middle">Dynamic PAT</td>
<td valign="middle">nat (inside) 1 10.1.1.0 255.255.255.0global (outside) 1 209.165.201.254</td>
<td valign="middle">object network internal_netsubnet 10.1.1.0 255.255.255.0!

object network internal_net

&nbsp;

nat (inside,outside) dynamic 209.165.201.254</td>
</tr>
<tr>
<td valign="middle">Dynamic NAT with Interface Overload</td>
<td valign="middle">nat (inside) 1 10.1.1.0 255.255.255.0global (outside) 1 interface

&nbsp;

global (outside) 1 209.165.201.1-209.165.201.2</td>
<td valign="middle">object network NAT_Poolrange 209.165.201.2 209.165.201.50object network internal_net

subnet 10.1.1.0 255.255.255.0

!

object network internal_net

nat (inside,outside) dynamic NAT_Pool interface</td>
</tr>
</tbody>
</table>
&nbsp;

<!--more-->

The next big one is ACLs (Access Control Lists).  The command syntax hasn't changed much for these, just the IP that is used for the rule.

&nbsp;

In the past when you were allowing traffic to a server you would configure it to point to the public IP that the server was NAT'd to.  Now it is configured to the internal address.  For example....

&nbsp;

Below is the way you would normally configure an ACL

&nbsp;

static (inside,outside) 208.268.11.17 10.100.1.11 netmask 255.255.255.255

!

access-list outside_in extended permit tcp any host 208.268.11.17

access-group outside_in in interface outside

&nbsp;

With 8.3 you use network objects, like below.

&nbsp;

object network obj-10.100.1.11

host 10.100.1.11

nat (inside,outside) static 208.268.11.17

!

access-list outside_in extended permit tcp any host 10.100.1.11

access-group outside_in in interface outside

&nbsp;

You can see the difference.

&nbsp;

The big caveat with the upgrade is that the process is supposed to make the adjustments automatically.  I have found that is not always the case.  All the static NATs tend to need some tweaking, as well as a lot of the Access Rules.

&nbsp;

Best bet is to make sure that you have a good understanding of the changes before diving into the upgrade.

&nbsp;

Thanks to <a title="Cisco Support Forums" href="https://supportforums.cisco.com/docs/DOC-12690" target="_blank">Cisco Support Forums</a> for the information.