Symptom

When using nested object groups within Network Address Translation (NAT) configuration on Adaptive Security Appliance (ASA) running 8.3 and later software, changes made in an object-group that is more than one level down from the one referenced in nat command are not reflected until the object-group or NAT statement are removed and readded.

Conditions

Object-groups with more than one nested level are used within NAT configuration.

Workaround

Remove and readd the object-group or NAT statement or redesign the object-group to use no more than one level of nesting.

Further Problem Description