Cisco ASA 5508-X, Руководство по настройке

Страница: 192 / 428

9-34
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 9 Network Address Translation (NAT)
Static NAT
hostname(config)# object network my-mapped-obj
hostname(config-network-object)# host 10.2.2.2
hostname(config-network-object)# object network my-host-obj1
hostname(config-network-object)# host 10.1.1.1
hostname(config-network-object)# nat (inside,outside) static my-mapped-obj
The following example configures static NAT-with-port-translation for 10.1.1.1 at TCP port 21 to the
outside interface at port 2121.
hostname(config)#
object network my-ftp-server
hostname(config-network-object)# host 10.1.1.1
hostname(config-network-object)# nat (inside,outside) static interface service tcp 21 2121
The following example maps an inside IPv4 network to an outside IPv6 network.
hostname(config)# object network inside_v4_v6
hostname(config-network-object)# subnet 10.1.1.0 255.255.255.0
hostname(config-network-object)# nat (inside,outside) static 2001:DB8::/96
The following example maps an inside IPv6 network to an outside IPv6 network.
hostname(config)#
object network inside_v6
hostname(config-network-object)# subnet 2001:DB8:AAAA::/96
hostname(config-network-object)# nat (inside,outside) static 2001:DB8:BBBB::/96
Configure Static Twice NAT or Static NAT-with-Port-Translation
This section describes how to configure a static NAT rule using twice NAT.
Procedure
Step 1 Create host or range network objects ( object network command), or network object groups
( object-group network command), for the source real addresses, the source mapped addresses, the
destination real addresses, and the destination mapped addresses.
•
If you want to configure source static interface NAT with port translation only, you can skip adding
an object for the source mapped addresses, and instead specify the
interface keyword in the nat
command.
• If you want to configure destination static interface NAT with port translation only, you can skip
adding an object for the destination mapped addresses, and instead specify the
interface keyword
in the nat command.
If you do create objects, consider the following guidelines:
•
The mapped object or group can contain a host, range, or subnet.
•
The static mapping is typically one-to-one, so the real addresses have the same quantity as the
mapped addresses. You can, however, have different quantities if desired. For more information, see
Static NAT, page 9-27 .
Step 2
(Optional.) Create service objects for the:
•
Source or Destination real ports
• Source or Destination mapped ports