Cisco ASA 5508-X, Configuration Manual

Page: 171 / 428

9-13
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 9 Network Address Translation (NAT)
Dynamic NAT
The following figure shows a remote host attempting to initiate a connection to a mapped address. This
address is not currently in the translation table; therefore, the ASA drops the packet.
Figure 9-3 Remote Host Attempts to Initiate a Connection to a Mapped Address
Dynamic NAT Disadvantages and Advantages
Dynamic NAT has these disadvantages:
•
If the mapped pool has fewer addresses than the real group, you could run out of addresses if the
amount of traffic is more than expected.
Use PAT or a PAT fall-back method if this event occurs often because PAT provides over 64,000
translations using ports of a single address.
•
You have to use a large number of routable addresses in the mapped pool, and routable addresses
may not be available in large quantities.
The advantage of dynamic NAT is that some protocols cannot use PAT. PAT does not work with the
following:
•
IP protocols that do not have a port to overload, such as GRE version 0.
•
Some multimedia applications that have a data stream on one port, the control path on another port,
and are not open standard.
See Default Inspections and NAT Limitations, page 12-6 for more information about NAT and PAT
support.
We b S erver
www.ex a mple.com
O u t s ide
In s ide
209.165.201.2
10.1.2.1
10.1.2.27
S ec u rity
Appli a nce
209.165.201.10
132217