Cisco 500 Series, Configuration Manual

Page: 346 / 1140

17-30
Cisco Security Appliance Command Line Configuration Guide
OL-12172-03
Chapter 17 Configuring NAT
Bypassing NAT
If you also have a separate translation for all inside traffic, and the inside hosts use a different mapped
address from the Telnet server, you can still configure traffic initiated from the Telnet server to use the
same mapped address as the
static statement that allows Telnet traffic to the server. You need to create
a more exclusive nat statement just for the Telnet server. Because nat statements are read for the best
match, more exclusive nat statements are matched before general statements. The following example
shows the Telnet static statement, the more exclusive nat statement for initiated traffic from the Telnet
server, and the statement for other inside hosts, which uses a different mapped address.
hostname(config)# static (inside,outside) tcp 10.1.2.14 telnet 10.1.1.15 telnet netmask
255.255.255.255
hostname(config)# nat (inside) 1 10.1.1.15 255.255.255.255
hostname(config)# global (outside) 1 10.1.2.14
hostname(config)#
nat (inside) 2 10.1.1.0 255.255.255.0
hostname(config)# global (outside) 2 10.1.2.78
To translate a well-known port (80) to another port (8080), enter the following command:
hostname(config)# static (inside,outside) tcp 10.1.2.45 80 10.1.1.16 8080 netmask
255.255.255.255
Bypassing NAT
This section describes how to bypass NAT. You might want to bypass NAT when you enable NAT control.
You can bypass NAT using identity NAT, static identity NAT, or NAT exemption. See the
“Bypassing
NAT When NAT Control is Enabled” section on page 17-10 for more information about these methods.
This section includes the following topics:
• Configuring Identity NAT, page 17-30
•
Configuring Static Identity NAT, page 17-31
• Configuring NAT Exemption, page 17-33
Configuring Identity NAT
Identity NAT translates the real IP address to the same IP address. Only “translated” hosts can create
NAT translations, and responding traffic is allowed back.
Figure 17-24 shows a typical identity NAT scenario.
Figure 17-24 Identity NAT
209.165.201.1 209.165.201.1
Inside Outside
209.165.201.2 209.165.201.2
130033
Security
Appliance