Cisco ASA 5508-X, Configuration Manual

Page: 160 / 428

9-2
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 9 Network Address Translation (NAT)
NAT Basics
•
Flexibility—You can change internal IP addressing schemes without affecting the public addresses
available externally; for example, for a server accessible to the Internet, you can maintain a fixed IP
address for Internet use, but internally, you can change the server address.
• Translating between IPv4 and IPv6 (Routed mode only) —If you want to connect an IPv6 network
to an IPv4 network, NAT lets you translate between the two types of addresses.
Note NAT is not required. If you do not configure NAT for a given set of traffic, that traffic will not be
translated, but will have all of the security policies applied as normal.
NAT Basics
The following topics explain some of the basics of NAT.
•
NAT Terminology, page 9-2
•
NAT Types, page 9-3
•
Network Object NAT and Twice NAT, page 9-3
• NAT Rule Order, page 9-5
•
NAT Interfaces, page 9-6
NAT Terminology
This document uses the following terminology:
•
Real address/host/network/interface—The real address is the address that is defined on the host,
before it is translated. In a typical NAT scenario where you want to translate the inside network when
it accesses the outside, the inside network would be the “real” network. Note that you can translate
any network connected to the ASA, not just an inside network, Therefore if you configure NAT to
translate outside addresses, “real” can refer to the outside network when it accesses the inside
network.
• Mapped address/host/network/interface—The mapped address is the address that the real address is
translated to. In a typical NAT scenario where you want to translate the inside network when it
accesses the outside, the outside network would be the “mapped” network.
Note
During address translation, IP addresses residing on the ASA’s interfaces are not translated.
•
Bidirectional initiation—Static NAT allows connections to be initiated bidirectionally , meaning
both to the host and from the host.
•
Source and destination NAT—For any given packet, both the source and destination IP addresses are
compared to the NAT rules, and one or both can be translated/untranslated. For static NAT, the rule
is bidirectional, so be aware that “source” and “destination” are used in commands and descriptions
throughout this guide even though a given connection might originate at the “destination” address.