31-3
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter31 Configuring Twice NAT
Default Settings
Additional Guidelines
If you change the NAT configuration, and you do not want to wait for existing translations to time
out before the new NAT information is used, you can clear the translation table using the clear xlate
command. However, clearing the translation table disconnects all current connections that use
translations.
Note If you remove a dynamic NAT or PAT rule, and then add a new rule with mapped addresses
that overlap the addresses in the removed rule, then the new rule will not be used until all
connections associated with the removed rule time out or are cleared using the clear xlate
command. This safeguard ensures that the same address is not assigned to multiple hosts.
Objects and object groups used in NAT cannot be undefined; they must include IP addresses.
You can use the same objects in multiple rules.
The mapped IP address pool cannot include:
The mapped interface IP address. If you specify any interface for the rule, then all interface IP
addresses are disallowed. For interface PAT (routed mode only), use the interface keyword
instead of the IP address.
(Transparent mode) The management IP address.
(Dynamic NAT) The standby interface IP address when VPN is enabled.
Existing VPN pool addresses.
Default Settings
By default, the rule is added to the end of section 1 of the NAT table.
(Routed mode) The default real and mapped interface is Any, which applies the rule to all interfaces.
(8.3(1), 8.3(2), and 8.4(1)) The default behavior for identity NAT has proxy ARP disabled. You
cannot configure this setting. (8.4(2) and later) The default behavior for identity NAT has proxy
ARP enabled, matching other static NAT rules. You can disable proxy ARP if desired.
If you specify an optional interface, then the ASA uses the NAT configuration to determine the
egress interface. (8.3(1) through 8.4(1)) The only exception is for identity NAT, which always uses
a route lookup, regardless of the NAT configuration. (8.4(2) and later) For identity NAT, the default
behavior is to use the NAT configuration, but you have the option to always use a route lookup
instead.
Configuring Twice NAT
This section describes how to configure twice NAT. This section includes the following topics:
Configuring Dynamic NAT, page31-4
Configuring Dynamic PAT (Hide), page 31-8
Configuring Static NAT or Static NAT-with-Port-Translation, page 31-15
Configuring Identity NAT, page31-20