Cisco ASA 5506-X Configuration Manual page 68

Dynamic NAT
Configure Dynamic Twice NAT
This section describes how to configure twice NAT for dynamic NAT.
Procedure
Step 1 Create host or range network objects (object network command), or network object groups
(object-group network command), for the source real addresses, the source mapped addresses, the
destination real addresses, and the destination mapped addresses.
•
•
If you do create objects, consider the following guidelines:
•
•
•
(Optional.) Create service objects for the destination real ports and the destination mapped ports.
Step 2
For dynamic NAT, you can only perform port translation on the destination. A service object can contain
both a source and destination port, but only the destination port is used in this case. If you specify the
source port, it will be ignored.
Step 3 Configure dynamic NAT.
nat [(real_ifc,mapped_ifc)] [line | {after-auto [line]}]
source dynamic {real_obj | any}
{mapped_obj [interface [ipv6]]}
[destination static {mapped_obj | interface [ipv6]} real_obj]
[service mapped_dest_svc_obj real_dest_svc_obj]
[dns] [unidirectional] [inactive] [description desc]
Example
hostname(config)# nat (inside,outside) source dynamic MyInsNet NAT_POOL
destination static Server1_mapped Server1 service MAPPED_SVC REAL_SVC
Where:
•
•
•
Cisco ASA Series Firewall CLI Configuration Guide
4-16
If you want to translate all source traffic, you can skip adding an object for the source real addresses,
and instead specify the any keyword in the nat command.
If you want to configure destination static interface NAT with port translation only, you can skip
adding an object for the destination mapped addresses, and instead specify the interface keyword
in the nat command.
You typically configure a larger group of real addresses to be mapped to a smaller group.
The object or group cannot contain a subnet; the object must define a range; the group can include
hosts and ranges.
If a mapped network object contains both ranges and host IP addresses, then the ranges are used for
dynamic NAT, and then the host IP addresses are used as a PAT fallback.
Interfaces—(Required for transparent mode) Specify the real (real_ifc) and mapped (mapped_ifc)
interfaces. Be sure to include the parentheses. In routed mode, if you do not specify the real and
mapped interfaces, all interfaces are used. You can also specify the keyword any for one or both of
the interfaces, for example (any,outside).
Section and Line—(Optional.) By default, the NAT rule is added to the end of section 1 of the NAT
table (see NAT Rule Order, page
network object NAT rules), then use the after-auto keyword. You can insert a rule anywhere in the
applicable section using the line argument.
Source addresses:
Real—Specify a network object, group, or the any keyword.
–
4-5). If you want to add the rule into section 3 instead (after the
Chapter 4 Network Address Translation (NAT