Filter
Top Products
5-2
Cisco ASA Series Firewall ASDM Configuration Guide
Chapter 5 Configuring Twice NAT (ASA 8.3 and Later)
Licensing Requirements for Twice NAT
Twice NAT also lets you use service objects for static NAT-with-port-translation; network object NAT
only accepts inline definition.
For detailed information about the differences between twice NAT and network object NAT, see the
“How NAT is Implemented” section on page 3-15.
Twice NAT rules are added to section 1 of the NAT rules table, or if specified, section 3. For more
information about NAT ordering, see the “NAT Rule Order” section on page 3-20.
Licensing Requirements for Twice NAT
Prerequisites for Twice NAT
• For both the real and mapped addresses, configure network objects or network object groups.
Network object groups are particularly useful for creating a mapped address pool with discontinuous
IP address ranges or multiple hosts or subnets. To create a network object or group, see the
“Configuring Network Objects and Groups” section on page 20-2 in the general operations
configuration guide.
• For static NAT-with-port-translation, configure TCP or UDP service objects. To create a service
object, see the “Configuring Service Objects and Service Groups” section on page 20-5 in the
general operations configuration guide.
For specific guidelines for objects and groups, see the configuration section for the NAT type you want
to configure. See also the “Guidelines and Limitations” section.
Guidelines and Limitations
This section includes the guidelines and limitations for this feature.
Context Mode Guidelines
Supported in single and multiple context mode.
Firewall Mode Guidelines
• Supported in routed and transparent firewall mode.
• In transparent mode, you must specify the real and mapped interfaces; you cannot use --Any--.
• In transparent mode, you cannot configure interface PAT, because the transparent mode interfaces
do not have IP addresses. You also cannot use the management IP address as a mapped address.
• In transparent mode, translating between IPv4 and IPv6 networks is not supported. Translating
between two IPv6 networks, or between two IPv4 networks is supported.
Model License Requirement
All models Base License.