instant000 wrote: »
Hah, a past gig ran a mix of 8.2, 8.3, and 8.4. Some with and without "nat-control" turned on. It made you very "on your toes" whenever you had to troubleshoot an issue, unnecessarily complicated by "nat-control" and multiple version NAT requirements, as if it's not enough just to make sure the traffic is getting to the right location, you also have to be sure that it is translated correctly.
A great command to use is the "packet-tracer". I know that I use it daily. (Not the GUI version, but the command line version.) Once you get to using packet-tracer, your people will be very happy to have it at their disposal. (FWSM doesn't have it. From my perspective, packet-tracer was the killer app the ASA had.)
Also, the ASDM real-time logger is okay to use from time-to-time when you're trying to track down an issue.
The main thing I have to warn you about with the contexts is that depending on how you set it up, and you choose to go Active/Active with your ASA's, keep in mind that if one of them goes down, the other one will have to be able to support all of the contexts, and the device is supposed to set aside resources to accomodate the contexts running on its partner, anyway ... for this reason, running Active/Standby would be better, unless you need the higher bandwidth that I guess you would momentarily get from running Active/Active.
The best thing is that with the arrival of 8.3, I was able to find several places in Cisco documentation that were recommending turning off nat-control.
Anyway, since you probably are dealing with the NAT transitions, when i was trying to understand it, I found this link that gave one of the simplest comparisons I could find:
Cisco ASA 8.3 / 8.4 NAT Guide (simple yet practical overview) « OSI Matrix