Policy Nat - Cisco Catalyst 6500 Series Configuration Manual
Catalyst 6500 series switch and
cisco 7600 series router firewall services
Hide thumbs
Also See for Catalyst 6500 Series:
- Software configuration manual (570 pages) ,
- Configuration note (212 pages) ,
- Installation manual (194 pages)
Table of Contents
Advertisement
Chapter 9
Configuring Network Address Translation
NAT Overview
Policy NAT
Policy NAT lets you identify local traffic for address translation by specifying the source and destination
addresses in an extended ACL. You can also optionally specify the source and destination ports. Regular
NAT can only consider the local addresses.
All types of NAT support policy NAT except for NAT exemption. NAT exemption uses an ACL to
Note
identify the local addresses, but differs from policy NAT in that the ports are not considered. See the
"Bypassing NAT" section on page 9-29
for other differences.
With policy NAT, you can create multiple NAT or static statements that identify the same local address
as long as the source/port and destination/port combination is unique for each statement. You can then
match different global addresses to each source/port and destination/port pair.
Figure 9-3
shows a host on the 10.1.2.0/24 network accessing two different servers. When the host
accesses the server at 209.165.201.11, the local address is translated to 209.165.202.129. When the host
accesses the server at 209.165.200.225, the local address is translated to 209.165.202.130 so that the host
appears to be on the same network as the servers, which can help with routing.
Figure 9-3
Policy NAT with Different Destination Addresses
Server 1
Server 2
209.165.201.11
209.165.200.225
209.165.201.0/27
209.165.200.224/27
DMZ
FWSM
Source Addr Translation
Source Addr Translation
10.1.2.27
209.165.202.129
10.1.2.27
209.165.202.130
Inside
10.1.2.0/24
Packet
Packet
Dest. Address:
Dest. Address:
209.165.201.11
209.165.200.225
10.1.2.27
See the following commands for this example:
FWSM/contexta(config)# access-list NET1 permit ip 10.1.2.0 255.255.255.0 209.165.201.0
255.255.255.224
FWSM/contexta(config)# access-list NET2 permit ip 10.1.2.0 255.255.255.0 209.165.200.224
255.255.255.224
FWSM/contexta(config)# nat (inside) 1 access-list NET1
FWSM/contexta(config)# global (outside) 1 209.165.202.129
FWSM/contexta(config)# nat (inside) 2 access-list NET2
FWSM/contexta(config)# global (outside) 2 209.165.202.130
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide
9-8
OL-6392-01
Advertisement
Table of Contents
Troubleshooting
