Cisco ASA 5506-X Configuration Manual page 66

Dynamic NAT
Configure Dynamic Network Object NAT
This section describes how to configure network object NAT for dynamic NAT.
Procedure
Step 1 Create a host or range network object (object network command), or a network object group
(object-group network command), for the mapped addresses.
•
•
Create or edit the network object for which you want to configure NAT.
Step 2
object network obj_name
Example
hostname(config)# object network my-host-obj1
Step 3 (Skip when editing an object that has the right address.) Define the real IPv4 or IPv6 addresses that you
want to translate.
•
•
•
Example
hostname(config-network-object)# host 10.2.2.2
Configure dynamic NAT for the object IP addresses. You can only define a single NAT rule for a given
Step 4
object.
nat [(real_ifc,mapped_ifc)] dynamic mapped_obj [interface [ipv6]] [dns]
Example
hostname(config-network-object)# nat (inside,outside) dynamic MAPPED_IPS interface
Where:
•
•
Cisco ASA Series Firewall CLI Configuration Guide
4-14
The object or group cannot contain a subnet; the object must define a range; the group can include
hosts and ranges.
If a mapped network object contains both ranges and host IP addresses, then the ranges are used for
dynamic NAT, and then the host IP addresses are used as a PAT fallback.
host {IPv4_address | IPv6_address}—The IPv4 or IPv6 address of a single host. For example,
10.1.1.1 or 2001:DB8::0DB8:800:200C:417A.
subnet {IPv4_address IPv4_mask | IPv6_address/IPv6_prefix}—The address of a network. For
IPv4 subnets, include the mask after a space, for example, 10.0.0.0 255.0.0.0. For IPv6, include the
address and prefix as a single unit (no spaces), such as 2001:DB8:0:CD30::/60.
range start_address end_address—A range of addresses. You can specify IPv4 or IPv6 ranges. Do
not include masks or prefixes.
Interfaces—(Required for transparent mode) Specify the real (real_ifc) and mapped (mapped_ifc)
interfaces. Be sure to include the parentheses. In routed mode, if you do not specify the real and
mapped interfaces, all interfaces are used. You can also specify the keyword any for one or both of
the interfaces, for example (any,outside).
Mapped IP address—Specify the network object or network object group that includes the mapped
IP addresses.
Chapter 4 Network Address Translation (NAT