30-5
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter30 Configuring Network Object NAT
Configuring Network Object NAT
Examples
The following example configures dynamic NAT that hides 192.168.2.0 network behind a range of
outside addresses 10.2.2.1 through 10.2.2.10:
hostname(config)# object network my-range-obj
hostname(config-network-object)# range 10.2.2.1 10.2.2.10
hostname(config)# object network my-inside-net
hostname(config-network-object)# subnet 192.168.2.0 255.255.255.0
hostname(config-network-object)# nat (inside,outside) dynamic my-range-obj
The following example configures dynamic NAT with dynamic PAT backup. Hosts on inside network
10.76.11.0 are mapped first to the nat-range1 pool (10.10.10.10-10.10.10.20). After all addresses in the
nat-range1 pool are allocated, dynamic PAT is performed using the pat-ip1 address (10.10.10.21). In the
unlikely event that the PAT translations are also use up, dynamic PAT is performed using the outside
interface address.
hostname(config)# object network nat-range1
hostname(config-network-object)# range 10.10.10.10 10.10.10.20
hostname(config-network-object)# object network pat-ip1
hostname(config-network-object)# host 10.10.10.21
hostname(config-network-object)# object-group network nat-pat-grp
hostname(config-network-object)# network-object object nat-range1
hostname(config-network-object)# network-object object pat-ip1
hostname(config-network-object)# object network my_net_obj5
hostname(config-network-object)# subnet 10.76.11.0 255.255.255.0
hostname(config-network-object)# nat (inside,outside) dynamic nat-pat-grp interface
Step4 nat [(real_ifc,mapped_ifc)] dynamic
mapped_obj [interface] [dns]
Example:
hostname(config-network-object)# nat
(inside,outside) dynamic MAPPED_IPS
interface
Configures dynamic NAT for the object IP addresses.
Note You can only define a single NAT rule for a given object. See
the “Additional Guidelines” section on page30-2.
See the following guidelines:
•Interfaces—(Required for transparent mode) Specify the real
and mapped interfaces. Be sure to include the parentheses in
your command. In routed mode, if you do not specify the real
and mapped interfaces, all interfaces are used; you can also
specify the keyword any for one or both of the interfaces.
•Mapped IP address—Specify the mapped IP address as:
–
An existing network object (see Step1).
–
An existing network object group (see Step1).
•Interface PAT fallback—(Optional) The interface keyword
enables interface PAT fallback. After the mapped IP addresses
are used up, then the IP address of the mapped interface is used.
For this option, you must configure a specific interface for the
mapped_ifc. (You cannot specify interface in transparent
mode).
•DNS—(Optional) The dns keyword translates DNS replies. Be
sure DNS inspection is enabled (it is enabled by default). See the
“DNS and NAT” section on page29-24 for more information.
Command Purpose