Cisco ASA 5506-X Configuration Manual page 105

Chapter 5 NAT Examples and Reference
Add a network object for the DMZ network 1:
Step 2
hostname(config)# object network DMZnetwork1
hostname(config-network-object)# subnet 209.165.201.0 255.255.255.224
Add a network object for the PAT address:
Step 3
hostname(config)# object network PATaddress1
hostname(config-network-object)# host 209.165.202.129
Configure the first twice NAT rule:
Step 4
hostname(config)# nat (inside,dmz) source dynamic myInsideNetwork PATaddress1
destination static DMZnetwork1 DMZnetwork1
Because you do not want to translate the destination address, you need to configure identity NAT for it
by specifying the same address for the real and mapped destination addresses.
Add a network object for the DMZ network 2:
Step 5
hostname(config)# object network DMZnetwork2
hostname(config-network-object)# subnet 209.165.200.224 255.255.255.224
Add a network object for the PAT address:
Step 6
hostname(config)# object network PATaddress2
hostname(config-network-object)# host 209.165.202.130
Step 7 Configure the second twice NAT rule:
hostname(config)# nat (inside,dmz) source dynamic myInsideNetwork PATaddress2
destination static DMZnetwork2 DMZnetwork2
Different Translation Depending on the Destination Address and Port (Dynamic
PAT)
The following figure shows the use of source and destination ports. The host on the 10.1.2.0/24 network
accesses a single host for both web services and Telnet services. When the host accesses the server for
Telnet services, the real address is translated to 209.165.202.129:port. When the host accesses the same
server for web services, the real address is translated to 209.165.202.130:port.
Cisco ASA Series Firewall CLI Configuration Guide
Examples for Twice NAT
5-7