Filter
Top Products
4-6
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 4 Configuring Network Object NAT
Configuring Network Object NAT
Examples
The following example configures dynamic NAT that hides 192.168.2.0 network behind a range of
outside addresses 10.2.2.1 through 10.2.2.10:
ciscoasa(config)# object network my-range-obj
ciscoasa(config-network-object)# range 10.2.2.1 10.2.2.10
ciscoasa(config)# object network my-inside-net
ciscoasa(config-network-object)# subnet 192.168.2.0 255.255.255.0
ciscoasa(config-network-object)# nat (inside,outside) dynamic my-range-obj
The following example configures dynamic NAT with dynamic PAT backup. Hosts on inside network
10.76.11.0 are mapped first to the nat-range1 pool (10.10.10.10-10.10.10.20). After all addresses in the
nat-range1 pool are allocated, dynamic PAT is performed using the pat-ip1 address (10.10.10.21). In the
unlikely event that the PAT translations are also used up, dynamic PAT is performed using the outside
interface address.
ciscoasa(config)# object network nat-range1
ciscoasa(config-network-object)# range 10.10.10.10 10.10.10.20
ciscoasa(config-network-object)# object network pat-ip1
Step 3
{host ip_address | subnet subnet_address
netmask | range ip_address_1 ip_address_2}
Example:
ciscoasa(config-network-object)# subnet
10.1.1.0 255.255.255.0
If you are creating a new network object, defines the real IP
address(es) (either IPv4 or IPv6) that you want to translate.
Step 4
nat [(real_ifc,mapped_ifc)] dynamic
mapped_obj [interface [ipv6]] [dns]
Example:
ciscoasa(config-network-object)# nat
(inside,outside) dynamic MAPPED_IPS
interface
Configures dynamic NAT for the object IP addresses.
Note You can only define a single NAT rule for a given object. See
the “Additional Guidelines” section on page 4-3.
See the following guidelines:
• Interfaces—(Required for transparent mode) Specify the real
and mapped interfaces. Be sure to include the parentheses in
your command. In routed mode, if you do not specify the real
and mapped interfaces, all interfaces are used; you can also
specify the keyword any for one or both of the interfaces.
• Mapped IP address—Specify the mapped IP address as:
–
An existing network object (see Step 1).
–
An existing network object group (see Step 1).
• Interface PAT fallback—(Optional) The interface keyword
enables interface PAT fallback. After the mapped IP addresses
are used up, then the IP address of the mapped interface is used.
If you specify ipv6, then the IPv6 address of the interface is
used. For this option, you must configure a specific interface for
the mapped_ifc. (You cannot specify interface in transparent
mode).
• DNS—(Optional) The dns keyword translates DNS replies. Be
sure DNS inspection is enabled (it is enabled by default). See
the “DNS and NAT” section on page 3-28 for more information.
Command Purpose