Cisco Systems ASA5515K9, ASA 5500 - page 593

30-11
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter30 Configuring Network Object NAT
Configuring Network Object NAT
Step4 nat [(real_ifc,mapped_ifc)] static
{mapped_inline_ip | mapped_obj |
interface} [dns | service {tcp | udp}
real_port mapped_port] [no-proxy-arp]
Example:
hostname(config-network-object)# nat
(inside,outside) static MAPPED_IPS service
tcp 80 8080
Configures static NAT for the object IP addresses.
Note You can only define a single NAT rule for a given object.
See the “Additional Guidelines” section on page30-2.
See the following guidelines:
•Interfaces—(Required for transparent mode) Specify the real
and mapped interfaces. Be sure to include the parentheses in
your command. In routed mode, if you do not specify the real
and mapped interfaces, all interfaces are used; you can also
specify the keyword any for one or both of the interfaces.
•Mapped IP Addresses—You can specify the mapped IP
address as:
– An inline IP address. The netmask or range for the
mapped network is the same as that of the real network.
For example, if the real network is a host, then this
address will be a host address. In the case of a range, then
the mapped addresses include the same number of
addresses as the real range. For example, if the real
address is defined as a range from 10.1.1.1 through
10.1.1.6, and you specify 172.20.1.1 as the mapped
address, then the mapped range will include 172.20.1.1
through 172.20.1.6.
– An existing network object or group (see Step1).
– interface—(Static NAT-with-port-translation only;
routed mode) For this option, you must configure a
specific interface for the mapped_ifc. Be sure to also
configure the service keyword.
Typically, you configure the same number of mapped
addresses as real addresses for a one-to-one mapping. You
can, however, have a mismatched number of addresses. For
more information, see the “Static NAT” section on page29-3.
•DNS—(Optional) The dns keyword translates DNS replies.
Be sure DNS inspection is enabled (it is enabled by default).
See the “DNS and NAT” section on page29-24 for more
information. This option is not available if you specify the
service keyword.
•Port translation—(Static NAT-with-port-translation only)
Specify tcp or udp and the real and mapped ports. You can
enter either a port number or a well-known port name (such
as ftp).
•No Proxy ARP—(Optional) Specify no-proxy-arp to disable
proxy ARP for incoming packets to the mapped IP addresses.
See the “Mapped Addresses and Routing” section on
page 29-22 for more information.
Command Purpose