Using Static Nat - Cisco 7604 Configuration Manual

Chapter 16 Configuring NAT
To identify a single real address with two different destination addresses using policy NAT, enter the
following commands. (See
hostname(config)# access-list NET1 permit ip 10.1.2.0 255.255.255.0 209.165.201.0
255.255.255.224
hostname(config)# access-list NET2 permit ip 10.1.2.0 255.255.255.0 209.165.200.224
255.255.255.224
hostname(config)# nat (inside) 1 access-list NET1 tcp 0 2000 udp 10000
hostname(config)# global (outside) 1 209.165.202.129
hostname(config)# nat (inside) 2 access-list NET2 tcp 1000 500 udp 2000
hostname(config)# global (outside) 2 209.165.202.130
To identify a single real address/destination address pair that use different ports using policy NAT, enter
the following commands. (See
hostname(config)# access-list WEB permit tcp 10.1.2.0 255.255.255.0 209.165.201.11
255.255.255.255 eq 80
hostname(config)# access-list TELNET permit tcp 10.1.2.0 255.255.255.0 209.165.201.11
255.255.255.255 eq 23
hostname(config)# nat (inside) 1 access-list WEB
hostname(config)# global (outside) 1 209.165.202.129
hostname(config)# nat (inside) 2 access-list TELNET
hostname(config)# global (outside) 2 209.165.202.130
FWSM and ASA behave differently when you configure dynamic NAT without the global keyword. On
Note
FWSM, an identity xlate is created, and the packet is forwarded. On the ASA, no xlate is created, and
the packet is dropped due to the missing global keyword.
In the following example, a packet sourced from 10.1.1.0/24 with a destination behind the outside
interface is forwarded on the FWSM but dropped on the ASA:
hostname(config)# nat (inside) 1 10.1.1.0 255.255.255.0 without global (outside) 1 X
To avoid this situation, configure NAT exemption (nat 0), or specify the global keyword.

Using Static NAT

This section describes how to configure a static translation.
Figure 16-22
remote hosts can originate connections, and the mapped address is statically assigned by the static
command.
Figure 16-22
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
OL-20748-01
Figure 16-9 on page 16-11
shows a typical static NAT scenario. The translation is always active so both translated and
Static NAT
FWSM
10.1.1.1 209.165.201.1
10.1.1.2 209.165.201.2
Inside Outside
for a related figure.)
Figure 16-10 on page 16-12 for a related figure.)
Using Static NAT
16-29