Cisco ASA 5508-X, Configuration Manual

Page: 191 / 428

9-33
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 9 Network Address Translation (NAT)
Static NAT
nat [ ( real_ifc , mapped_ifc ) ] static { mapped_inline_ip | mapped_obj | interface [ ipv6 ]}
[ net-to-net ] [ dns | service { tcp | udp } real_port mapped_port ] [ no-proxy-arp ]
Example
hostname(config-network-object)#
nat (inside,outside) static MAPPED_IPS service tcp 80 8080
Where:
•
Interfaces—(Required for transparent mode) Specify the real ( real_ifc ) and mapped ( mapped_ifc )
interfaces. Be sure to include the parentheses. In routed mode, if you do not specify the real and
mapped interfaces, all interfaces are used. You can also specify the keyword
any for one or both of
the interfaces, for example (any,outside).
• Mapped IP address—You can specify the mapped IP address as one of the following. Typically, you
configure the same number of mapped addresses as real addresses for a one-to-one mapping. You
can, however, have a mismatched number of addresses. See
Static NAT, page 9-27 .
–
mapped_inline_host_ip —An inline IP address. The netmask, prefix, or range for the mapped
network is the same as that of the real network. For example, if the real network is a host, then
this address will be a host address. In the case of a range, then the mapped addresses include the
same number of addresses as the real range. For example, if the real address is defined as a range
from 10.1.1.1 through 10.1.1.6, and you specify 172.20.1.1 as the mapped address, then the
mapped range will include 172.20.1.1 through 172.20.1.6.
– mapped_obj —An existing network object or group.
–
interface —(Static NAT-with-port-translation only; routed mode only.) The IP address of the
mapped interface is used as the mapped address. If you specify ipv6 , then the IPv6 address of
the interface is used. For this option, you must configure a specific interface for the mapped_ifc .
You must use this keyword when you want to use the interface IP address; you cannot enter it
inline or as an object. Be sure to also configure the
service keyword.
• Net-to-net—(Optional.) For NAT 46, specify net-to-net to translate the first IPv4 address to the first
IPv6 address, the second to the second, and so on. Without this option, the IPv4-embedded method
is used. For a one-to-one translation, you must use this keyword.
•
DNS—(Optional.) The dns keyword translates DNS replies. Be sure DNS inspection is enabled (it
is enabled by default). See DNS and NAT, page 10-21 for more information.
• Port translation—(Static NAT-with-port-translation only.) Specify service with either tcp or udp
and the real and mapped ports. You can enter either a port number or a well-known port name (such
as
ftp ).
•
No Proxy ARP—(Optional.) Specify no-proxy-arp to disable proxy ARP for incoming packets to
the mapped IP addresses. For information on the conditions which might require the disabling of
proxy ARP, see
Mapped Addresses and Routing, page 10-12 .
Examples
The following example configures static NAT for the real host 10.1.1.1 on the inside to 10.2.2.2 on the
outside with DNS rewrite enabled.
hostname(config)# object network my-host-obj1
hostname(config-network-object)# host 10.1.1.1
hostname(config-network-object)# nat (inside,outside) static 10.2.2.2 dns
The following example configures static NAT for the real host 10.1.1.1 on the inside to 10.2.2.2 on the
outside using a mapped object.