Cisco ASA Dynamic NAT Configuration

Hello Donald

This command within ASDM is the same as the nat-control command in the CLI.

When enabled, this feature requires that packets traversing from an INSIDE interface to an OUTSIDE interface match a NAT rule. If no NAT rule is matched, the packet is dropped.

If it is disabled, then this matching is not a requirement, and the packet can be forwarded and routed without a NAT translation (assuming it passes any other checks that have been implemented on the ASA).

For more info, take a look at the following link:
https://www.cisco.com/c/en/us/td/docs/security/asa/asa72/configuration/guide/conf_gd/cfgnat.html#wp1065218

Now whether you enable this or disable this depends upon what you want to achieve. If you require that all traffic initiated from INSIDE be translated (which is often the case at the edge of a network where ASA devices are often placed), then you should enable this. When enabled, hosts on the INSIDE network that must access hosts on the OUTSIDE network must match a NAT translation rule for such communication to be successful. Thus you must ensure that your NAT translation rules are appropriate to ensure such communication.

I hope this has been helpful!

Laz