Filter
Top Products
5-14
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 5 Configuring Twice NAT
Configuring Twice NAT
Step 3
nat [(real_ifc,mapped_ifc)]
[line |{after-auto [line]}]
source dynamic {real-obj | any}
{mapped_obj [interface [ipv6]] | [pat-pool
mapped_obj [round-robin] [extended]
[flat [include-reserve]] [interface
[ipv6]] | interface [ipv6]} [destination
static {mapped_obj | interface [ipv6]}
real_obj] [service mapped_dest_svc_obj
real_dest_svc_obj] [dns] [unidirectional]
[inactive] [description desc]
Example:
ciscoasa(config)# nat (inside,outside)
source dynamic MyInsNet interface
destination static Server1 Server1
description Interface PAT for inside
addresses when going to server 1
Configures dynamic PAT (hide). See the following guidelines:
• Interfaces—(Required for transparent mode) Specify the real
and mapped interfaces. Be sure to include the parentheses in
your command. In routed mode, if you do not specify the real
and mapped interfaces, all interfaces are used; you can also
specify the keyword any for one or both of the interfaces.
• Section and Line—(Optional) By default, the NAT rule is
added to the end of section 1 of the NAT table (see the “NAT
Rule Order” section on page 3-18). If you want to add the rule
into section 3 instead (after the network object NAT rules),
then use the after-auto keyword. You can insert a rule
anywhere in the applicable section using the line argument.
• Source addresses:
–
Real—Specify a network object, group, or the any
keyword. Use the any keyword if you want to translate all
traffic from the real interface to the mapped interface.
–
Mapped—Configure one of the following:
- Network object—Specify a network object that contains
a host address.
- pat-pool—Specify the pat-pool keyword and a network
object or group that contains multiple addresses.
- interface—(Routed mode only) Specify the interface
keyword alone to only use interface PAT. If you specify
ipv6, then the IPv6 address of the interface is used. When
specified with a PAT pool or network object, the
interface keyword enables interface PAT fallback. After
the PAT IP addresses are used up, then the IP address of
the mapped interface is used. For this option, you must
configure a specific interface for the mapped_ifc.
(continued)
Command Purpose