Filter
Top Products
5-16
Cisco ASA Series Firewall ASDM Configuration Guide
Chapter 5 Configuring Twice NAT (ASA 8.3 and Later)
Configuring Twice NAT
a. For the Match Criteria: Translated Packet > Source Address, click the browse button and choose an
existing network object or interface or create a new object from the Browse Translated Source
Address dialog box.
If you want to use the IPv6 address of the interface, check the Use IPv6 for interface PAT check
box.
b. For the Match Criteria: Translated Packet > Destination Address, click the browse button and choose
an existing network object or group or create a new object or group from the Browse Translated
Destination Address dialog box. The group cannot contain both IPv4 and IPv6 addresses; it must
contain one type only.
For identity NAT for the destination address, simply use the same object or group for both the real
and mapped addresses.
If you want to translate the destination address, then the static mapping is typically one-to-one, so
the real addresses have the same quantity as the mapped addresses. You can, however, have different
quantities if desired. For more information, see the “Static NAT” section on page 3-3. See the
“Guidelines and Limitations” section on page 5-2 for information about disallowed mapped IP
addresses.
For static interface NAT with port translation only, choose an interface from the Browse dialog box.
Be sure to also configure a service translation (see Step 7). For this option, you must configure a
specific interface for the Source Interface in Step 2. See the “Static Interface NAT with Port
Translation” section on page 3-6 for more information.
Step 7 (Optional) Identify the translated packet port (the real destination port). For the Match Criteria:
Translated Packet > Service, click the browse button and choose an existing TCP or UDP service object
from the Browse Translated Service dialog box.
Real: 192.168.1.1
Mapped: 10.1.1.1
Real: 10.1.2.2
Mapped: 192.168.2.2
NAT
Source Destination
Outside
Inside
10.1.2.2 ---> 10.1.1.1 192.168.2.2 ---> 192.168.1.1
Original Packet Translated Packet