Cisco ASA 5508-X, Руководство по настройке

Страница: 174 / 428

9-16
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 9 Network Address Translation (NAT)
Dynamic NAT
Configure Dynamic Twice NAT
This section describes how to configure twice NAT for dynamic NAT.
Procedure
Step 1
Create host or range network objects ( object network command), or network object groups
( object-group network command), for the source real addresses, the source mapped addresses, the
destination real addresses, and the destination mapped addresses.
• If you want to translate all source traffic, you can skip adding an object for the source real addresses,
and instead specify the
any keyword in the nat command.
•
If you want to configure destination static interface NAT with port translation only, you can skip
adding an object for the destination mapped addresses, and instead specify the
interface keyword
in the nat command.
If you do create objects, consider the following guidelines:
•
You typically configure a larger group of real addresses to be mapped to a smaller group.
• The object or group cannot contain a subnet; the object must define a range; the group can include
hosts and ranges.
•
If a mapped network object contains both ranges and host IP addresses, then the ranges are used for
dynamic NAT, and then the host IP addresses are used as a PAT fallback.
Step 2 (Optional.) Create service objects for the destination real ports and the destination mapped ports.
For dynamic NAT, you can only perform port translation on the destination. A service object can contain
both a source and destination port, but only the destination port is used in this case. If you specify the
source port, it will be ignored.
Step 3
Configure dynamic NAT .
nat [ ( real_ifc , mapped_ifc ) ] [ line | { after-auto [ line ]}]
source dynamic { real_obj | any }
{ mapped_obj [ interface [ ipv6 ]]}
[ destination static { mapped_obj | interface [ ipv6 ]} real_obj ]
[ service mapped_dest_svc_obj real_dest_svc_obj ]
[ dns ] [ unidirectional ] [ inactive ] [ description desc ]
Example
hostname(config)# nat (inside,outside) source dynamic MyInsNet NAT_POOL
destination static Server1_mapped Server1 service MAPPED_SVC REAL_SVC
Where:
•
Interfaces—(Required for transparent mode) Specify the real ( real_ifc ) and mapped ( mapped_ifc )
interfaces. Be sure to include the parentheses. In routed mode, if you do not specify the real and
mapped interfaces, all interfaces are used. You can also specify the keyword
any for one or both of
the interfaces, for example (any,outside).
•
Section and Line—(Optional.) By default, the NAT rule is added to the end of section 1 of the NAT
table (see
NAT Rule Order, page 9-5 ). If you want to add the rule into section 3 instead (after the
network object NAT rules), then use the after-auto keyword. You can insert a rule anywhere in the
applicable section using the line argument.
•
Source addresses:
–
Real—Specify a network object, group, or the any keyword.