Cisco 500 Series, Configuration Manual

Page: 322 / 1140

17-6
Cisco Security Appliance Command Line Configuration Guide
OL-12172-03
Chapter 17 Configuring NAT
NAT Overview
NAT Types
This section describes the available NAT types, and includes the following topics:
•
Dynamic NAT, page 17-6
• PAT, page 17-8
•
Static NAT, page 17-8
• Static PAT, page 17-9
•
Bypassing NAT When NAT Control is Enabled, page 17-10
You can implement address translation as dynamic NAT, Port Address Translation, static NAT, static
PAT, or as a mix of these types. You can also configure rules to bypass NAT; for example, to enable NAT
control when you do not want to perform NAT.
Dynamic NAT
Dynamic NAT translates a group of real addresses to a pool of mapped addresses that are routable on the
destination network. The mapped pool may include fewer addresses than the real group. When a host
you want to translate accesses the destination network, the security appliance assigns the host an IP
address from the mapped pool. The translation is added only when the real host initiates the connection.
The translation is in place only for the duration of the connection, and a given user does not keep the
same IP address after the translation times out. For an example, see the
timeout xlate command in the
Cisco Security Appliance Command Reference . Users on the destination network, therefore, cannot
initiate a reliable connection to a host that uses dynamic NAT, although the connection is allowed by an
access list, and the security appliance rejects any attempt to connect to a real host address directly. See
the
“Static NAT” or “Static PAT” section for information on how to obtain reliable access to hosts.
Note
In some cases, a translation is added for a connection, although the session is denied by the security
appliance. This condition occurs with an outbound access list, a management-only interface, or a backup
interface in which the translation times out normally. For an example, see the
show xlate command in
the Cisco Security Appliance Command Reference .
Figure 17-6 shows a remote host attempting to connect to the real address. The connection is denied,
because the security appliance only allows returning connections to the mapped address.