Cisco ASA 5508-X Configuration Manual Download

Page: 169 / 428

9-11

Cisco ASA Series Firewall CLI Configuration Guide

Chapter 9 Network Address Translation (NAT)

Guidelines for NAT

•

Source Identity NAT

–

The real and mapped objects must match. You can use the same object for both, or you can
create separate objects that contain the same IP addresses.

•

Destination Static NAT or Static NAT with port translation (the destination translation is always
static):

–

Although the main feature of twice NAT is the inclusion of the destination IP address, the
destination address is optional. If you do specify the destination address, you can configure
static translation for that address or just use identity NAT for it. You might want to configure
twice NAT without a destination address to take advantage of some of the other qualities of
twice NAT, including the use of network object groups for real addresses, or manually ordering
of rules. For more information, see

Comparing Network Object NAT and Twice NAT, page 9-4

–

For identity NAT, the real and mapped objects must match. You can use the same object for both,
or you can create separate objects that contain the same IP addresses.

–

The static mapping is typically one-to-one, so the real addresses have the same quantity as the
mapped addresses. You can, however, have different quantities if desired.

–

For static interface NAT with port translation (routed mode only), you can specify the

interface

keyword instead of a network object/group for the mapped address.

Twice NAT Guidelines for Service Objects for Real and Mapped Ports

You can optionally configure service objects for:

•

Source real port (Static only)

Destination real port

•

Source mapped port (Static only)

Destination mapped port

Use the

object service

command to create the objects.

Consider the following guidelines when creating objects for twice NAT.

•

NAT only supports TCP or UDP. When translating a port, be sure the protocols in the real and
mapped service objects are identical (both TCP or both UDP).

•

The “not equal” (

neq

) operator is not supported.

•

For identity port translation, you can use the same service object for both the real and mapped ports.

•

Source Dynamic NAT—Source Dynamic NAT does not support port translation.

•

Source Dynamic PAT (Hide)—Source Dynamic PAT does not support port translation.

•

Source Static NAT, Static NAT with port translation, or Identity NAT—A service object can contain
both a source and destination port; however, you should specify

either

the source

the destination

port for both service objects. You should only specify

both

the source and destination ports if your

application uses a fixed source port (such as some DNS servers); but fixed source ports are rare. For
example, if you want to translate the port for the source host, then configure the source service.

•

Destination Static NAT or Static NAT with port translation (the destination translation is always
static)—For non-static source NAT, you can only perform port translation on the destination. A
service object can contain both a source and destination port, but only the destination port is used
in this case. If you specify the source port, it will be ignored.