Cisco 5505 - ASA Firewall Edition Bundle, Cli Configuration Manual

Page: 824 / 2164

1-12
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring Twice NAT
Configuring Twice NAT
•
If available, the real source port number is used for the mapped port. However, if the real port is not
available, by default the mapped ports are chosen from the same range of ports as the real port
number: 0 to 511, 512 to 1023, and 1024 to 65535. Therefore, ports below 1024 have only a small
PAT pool that can be used. (8.4(3) and later, not including 8.5(1) or 8.6(1)) If you have a lot of traffic
that uses the lower port ranges, you can now specify a flat range of ports to be used instead of the
three unequal-sized tiers: either 1024 to 65535, or 1 to 65535.
•
If you use the same PAT pool object in two separate rules, then be sure to specify the same options
for each rule. For example, if one rule specifies extended PAT and a flat range, then the other rule
must also specify extended PAT and a flat range.
For extended PAT for a PAT pool:
•
Many application inspections do not support extended PAT. See the “Default Settings” section on
page 1-4 in Chapter 1, “Getting Started with Application Layer Protocol Inspection,” for a complete
list of unsupported inspections.
•
If you enable extended PAT for a dynamic PAT rule, then you cannot also use an address in the PAT
pool as the PAT address in a separate static NAT-with-port-translation rule. For example, if the PAT
pool includes 10.1.1.1, then you cannot create a static NAT-with-port-translation rule using 10.1.1.1
as the PAT address.
•
If you use a PAT pool and specify an interface for fallback, you cannot specify extended PAT.
•
For VoIP deployments that use ICE or TURN, do not use extended PAT. ICE and TURN rely on the
PAT binding to be the same for all destinations.
For round robin for a PAT pool:
•
If a host has an existing connection, then subsequent connections from that host will use the same
PAT IP address if ports are available.
Note : This “stickiness” does not survive a failover. If the ASA
fails over, then subsequent connections from a host may not use the initial IP address.
•
Round robin, especially when combined with extended PAT, can consume a large amount of
memory. Because NAT pools are created for every mapped protocol/IP address/port range, round
robin results in a large number of concurrent NAT pools, which use memory. Extended PAT results
in an even larger number of concurrent NAT pools.