Static Pat - Cisco 7604 Configuration Manual

Chapter 16 Configuring NAT
NAT Overview

Static PAT

Static PAT is the same as static NAT, except it lets you specify the protocol (TCP or UDP) and port for
the real and mapped addresses.
This feature lets you identify the same mapped address across many different static statements, so long
as the port is different for each statement. However, you cannot use the same mapped address for
multiple static NAT statements.
For applications that require application inspection for secondary channels (FTP, VoIP, and so on), the
FWSM automatically translates the secondary ports.
For example, if you want to provide a single address for remote users to access FTP, HTTP, and SMTP,
but these are all actually different servers on the real network, you can specify static PAT statements for
each server that uses the same mapped IP address, but different ports. (See Figure 16-8.)
Figure 16-8 Static PAT
Host
Outside
Undo Translation
209.165.201.3:21 10.1.2.27
Undo Translation
209.165.201.3:25 10.1.2.29
Undo Translation
209.165.201.3:80 10.1.2.28
Inside
FTP server SMTP server
10.1.2.27 10.1.2.29
HTTP server
10.1.2.28
See the following commands for this example:
hostname(config)# static (inside,outside) tcp 209.165.201.3 ftp 10.1.2.27 ftp netmask
255.255.255.255
hostname(config)# static (inside,outside) tcp 209.165.201.3 http 10.1.2.28 http netmask
255.255.255.255
hostname(config)# static (inside,outside) tcp 209.165.201.3 smtp 10.1.2.29 smtp netmask
255.255.255.255
You can also use static PAT to translate a well-known port to a non-standard port or vice versa. For
example, if your inside web servers use port 8080, you can allow outside users to connect to port 80, and
then undo translation to the original port 8080. Similarly, if you want to provide extra security, you can
tell your web users to connect to non-standard port 6785, and then undo translation to port 80.
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
16-9
OL-20748-01