Cisco ASA Series Cli Configuration Manual page 806

Configuration Examples for Network Object NAT
IPv4 DNS Server and FTP Server on Mapped Interface, IPv6 Host on Real
Interface (Static NAT64 with DNS64 Modification)
Figure 1-6
translation for the outside server. In this case, when an inside IPv6 user requests the address for
ftp.cisco.com from the DNS server, the DNS server responds with the real address, 209.165.200.225.
Because you want inside users to use the mapped address for ftp.cisco.com (2001:DB8::D1A5:C8E1)
you need to configure DNS reply modification for the static translation. This example also includes a
static NAT translation for the DNS server, and a PAT rule for the inside IPv6 hosts.
Figure 1-7
209.165.200.225
Step 1
Configure static NAT with DNS modification for the FTP server.
a.
b.
Cisco ASA Series CLI Configuration Guide
1-26
shows an FTP server and DNS server on the outside IPv4 network. The ASA has a static
DNS Reply Modification Using Outside NAT
Static Translation on Inside to:
2
DNS Reply
209.165.200.225
3
DNS Reply Modification
2001:DB8::D1A5:C8E1
4
DNS Reply
2001:DB8::D1A5:C8E1
Create a network object for the FTP server address.
hostname(config)# object network FTP_SERVER
Define the FTP server address, and configure static NAT with DNS modification and, because this
is a one-to-one translation, configure the net-to-net method for NAT46.
hostname(config-network-object)# host 209.165.200.225
hostname(config-network-object)# nat (outside,inside) static 2001:DB8::D1A5:C8E1/128
net-to-net dns
DNS Server
209.165.201.15
2001:DB8::D1A5:C90F
1
DNS Query
IPv4 Internet
ftp.cisco.com?
Security Device
IPv6 Net
User:
2001:DB8::1
PAT Translation on Outside to:
209.165.200.230
Chapter 1 Configuring Network Object NAT
ftp.cisco.com
209.165.200.225
Static Translation on Inside to:
2001:DB8::D1A5:C8E1
7
FTP Request
209.165.200.225
6
Dest Addr. Translation
2001:DB8::D1A5:C8E1
5
FTP Request
2001:DB8::D1A5:C8E1
209.165.200.225