Cisco 5505 - ASA Firewall Edition Bundle, Cli Configuration Manual

Page: 817 / 2164

1-5
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring Twice NAT
Configuring Twice NAT
Objects are required unless you specify the any keyword inline to represent all traffic, or for some types
of NAT, the interface keyword to represent the interface address. For more information about
configuring a network object or group, see the “Configuring Network Objects and Groups” section on
page 1-2 .
Guidelines
•
A network object group can contain objects and/or inline addresses of either IPv4 or IPv6 addresses.
The group cannot contain both IPv4 and IPv6 addresses; it must contain one type only.
•
See the “Guidelines and Limitations” section on page 1-2 for information about disallowed mapped
IP addresses.
•
Source Dynamic NAT:
–
You typically configure a larger group of real addresses to be mapped to a smaller group.
–
The mapped object or group cannot contain a subnet; the object must define a range; the group
can include hosts and ranges.
–
If a mapped network object contains both ranges and host IP addresses, then the ranges are used
for dynamic NAT, and the host IP addresses are used as a PAT fallback.
•
Source Dynamic PAT (Hide):
–
The mapped object or group cannot contain a subnet; a network object must define a host, or for
a PAT pool, a range; a network object group (for a PAT pool) can include hosts and ranges.
•
Source Static NAT or Static NAT with port translation:
–
The mapped object or group can contain a host, range, or subnet.
–
The static mapping is typically one-to-one, so the real addresses have the same quantity as the
mapped addresses. You can, however, have different quantities if desired. For more information,
see the
“Static NAT” section on page 1-3 .
•
Source Identity NAT
–
The real and mapped objects must match; you can use the same object for both, or you can create
separate objects that contain the same IP addresses.
•
Destination Static NAT or Static NAT with port translation (the destination translation is always
static):
–
Although the main feature of twice NAT is the inclusion of the destination IP address, the
destination address is optional. If you do specify the destination address, you can configure
static translation for that address or just use identity NAT for it. You might want to configure
twice NAT without a destination address to take advantage of some of the other qualities of
twice NAT, including the use of network object groups for real addresses, or manually ordering
of rules. For more information, see the
“Main Differences Between Network Object NAT and
Twice NAT” section on page 1-13 .
–
For identity NAT, the real and mapped objects must match; you can use the same object for both,
or you can create separate objects that contain the same IP addresses.
–
The static mapping is typically one-to-one, so the real addresses have the same quantity as the
mapped addresses. You can, however, have different quantities if desired. For more information,
see the
“Static NAT” section on page 1-3 .
–
For static interface NAT with port translation (routed mode only), you can specify the interface
keyword instead of a network object/group for the mapped address. For more information, see
the
“Static Interface NAT with Port Translation” section on page 1-5 .