Cisco ASA 5505 Configuration Manual page 562

Prerequisites for Twice NAT
Model License Requirement
All models Base License.
Prerequisites for Twice NAT
•
•
For specific guidelines for objects and groups, see the configuration section for the NAT type you want
to configure. See also the
Guidelines and Limitations
This section includes the guidelines and limitations for this feature.
Context Mode Guidelines
Supported in single and multiple context mode.
Firewall Mode Guidelines
•
•
•
IPv6 Guidelines
Does not support IPv6.
Additional Guidelines
•
•
Cisco ASA 5500 Series Configuration Guide using ASDM
28-2
For both the real and mapped addresses, configure network objects or network object groups.
Network object groups are particularly useful for creating a mapped address pool with discontinuous
IP address ranges or multiple hosts or subnets. To create a network object or group, see the
"Configuring Network Objects and Groups" section on page
For static NAT with port translation, configure TCP or UDP service objects. To create a service
object, see the "Configuring Service Objects and Service Groups" section on page
"Guidelines and Limitations"
Supported in routed and transparent firewall mode.
In transparent mode, you must specify the real and mapped interfaces; you cannot use --Any--.
In transparent mode, you cannot configure interface PAT, because the transparent mode interfaces
do not have IP addresses. You also cannot use the management IP address as a mapped address.
If you change the NAT configuration, and you do not want to wait for existing translations to time
out before the new NAT information is used, you can clear the translation table using the clear xlate
command. However, clearing the translation table disconnects all current connections that use
translations.
If you remove a dynamic NAT or PAT rule, and then add a new rule with mapped addresses
Note
that overlap the addresses in the removed rule, then the new rule will not be used until all
connections associated with the removed rule time out or are cleared using the clear xlate
command. This safeguard ensures that the same address is not assigned to multiple hosts.
Objects and object groups used in NAT cannot be undefined; they must include IP addresses.
Chapter 28
13-1.
section.
Configuring Twice NAT
13-5.
OL-20339-01