Cisco 7604 Configuration Manual page 339

Chapter 16 Configuring NAT
information about policy NAT.) For example, you can use policy static identity NAT for an inside address
when it accesses the outside interface and the destination is server A, but use a normal translation when
accessing the outside server B.
Figure 16-25
Figure 16-25
209.165.201.1
209.165.201.2
Note If you remove a static command, existing connections that use the translation are not affected. To remove
these connections, enter the clear local-host command.
Static translations from the translation table can be removed using the clear xlate command; the
translation table will be cleared and all current translations are deleted.
To configure static identity NAT, enter one of the following commands:
To configure policy static identity NAT, enter the following command:
•
hostname(config)# static (real_interface,mapped_interface) real_ip access-list acl_id
[dns] [[tcp] tcp_max_conns [emb_limit]] [udp udp_max_conns] [norandomseq]
Create the extended access list using the access-list extended command. (See the
Extended Access List" section on page
Make sure the source address in the access list matches the real_ip in this command. Policy NAT
and static NAT consider the inactive or time-range keywords and stop working when an ACE is
inactive. See the
See the
options.
To configure regular static identity NAT, enter the following command:
•
hostname(config)# static (real_interface,mapped_interface) real_ip real_ip
[netmask mask] [dns] [[tcp] tcp_max_conns [emb_limit]] [udp udp_max_conns]
[norandomseq]
Specify the same IP address for both real_ip arguments.
See the
options.
For example, the following command uses static identity NAT for an inside IP address (10.1.1.3) when
accessed by the outside:
hostname(config)# static (inside,outside) 10.1.1.3 10.1.1.3 netmask 255.255.255.255
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
OL-20748-01
shows a typical static identity NAT scenario.
Static Identity NAT
FWSM
209.165.201.1
209.165.201.2
Inside Outside
"Policy NAT" section on page 16-10
"Configuring Dynamic NAT or PAT" section on page 16-26
"Configuring Dynamic NAT or PAT" section on page 16-26
13-6.) This access list should include only permit ACEs.
for more information.
Bypassing NAT
"Adding an
for information about the other
for information about the other
16-35