I've hit a strange problem, well strange to me but probably blindingly obvious to others.

WAN link went down, eventually noticed that the line

nat (inside) 0 access-list NO-NAT

had disappeared from the running config. Bizarre, I tried to re add the line but got an error

access list has protocol or port

So I checked and I had recently added a line to the NO-NAT access list to allow our main Websense box to talk directly to the remote filter box in the DMZ, to do this I'd added

access-list NO-NAT extended permit tcp host x.x.x.x host x.x.x.x object-group WEBSENSE

All other entries in NO-NAT are ip not tcp. So there's my problem - removed that line and re added the nat 0 line and away it went.

But how do I resolve this properly - presumably I can't mix IP and TCP in the same ACL? The object group specified TCP ports - could I change it to IP? Presumably that would allow me to then readd the line in the NO-NAT ACL with IP not TCP (I tried it without changing the object group and no suprise it told me to go forth).

What's REALLY strange is that the config has been that way for weeks, but the nat 0 line didn't disappear till yesterday morning.

Advice gratefully received!

Edited 21 May, 200917 yr by Kaiserb_uk

Ooh, I've just found out about enhanced service object-groups which combine IP and TCP/UDP, but only in version 8 software. No chance of upgrading the ASA anytime soon though.

Are you talking cisco.

After the first change, dont forget to save the config otherwise if the router crashes and restarts then the config will be lost.

you mention its gone from the running config, so whats in the startup config?

Yeah, Cisco ASA. Didn't check the startup config , now overwritten after I resolved the problem.

Any ideas what the error meant when I tried to re-enter the nat 0 line?

Sorry as my understanding is limited to "halfway through a CCNA course" and my firewall experience is Checkpoint, but as you have stated tcp in the extended access-list then I think you must state the tcp port or ports too and not associate the object group that defines ports so ip should be used?

Sorry not sure if this is applicable to your ASA?

Cisco ASA 5500 Series Configuration Guide using the CLI, 8.2 - Adding an Extended Access List [Cisco ASA 5500 Series Adaptive Security Appliances] - Cisco Systems