Filter
Top Products
5-10
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 5 Configuring Twice NAT
Configuring Twice NAT
(Continued)
• Destination addresses (Optional):
–
Mapped—Specify a network object or group, or for static
interface NAT with port translation only, specify the
interface keyword. If you specify ipv6, then the IPv6
address of the interface is used. If you specify interface,
be sure to also configure the service keyword. For this
option, you must configure a specific interface for the
real_ifc. See the “Static Interface NAT with Port
Translation” section on page 3-5 for more information.
–
Real—Specify a network object or group. For identity
NAT, simply use the same object or group for both the
real and mapped addresses.
• Destination port—(Optional) Specify the service keyword
along with the mapped and real service objects. For identity
port translation, simply use the same service object for both
the real and mapped ports.
• DNS—(Optional; for a source-only rule) The dns keyword
translates DNS replies. Be sure DNS inspection is enabled (it
is enabled by default). You cannot configure the dns keyword
if you configure a destination address. See the “DNS and
NAT” section on page 3-28 for more information.
• Unidirectional—(Optional) Specify unidirectional so the
destination addresses cannot initiate traffic to the source
addresses.
• Inactive—(Optional) To make this rule inactive without
having to remove the command, use the inactive keyword. To
reactivate it, reenter the whole command without the inactive
keyword.
• Description—Optional) Provide a description up to 200
characters using the description keyword.
Command Purpose