Cisco Systems ASA5515K9, ASA 5500 - page 611

31-5
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter31 Configuring Twice NAT
Configuring Twice NAT
Step3 (Optional)
Network object:
object network obj_name
{host ip_address | subnet
subnet_address netmask | range
ip_address_1 ip_address_2}
Network object group:
object-group network grp_name
{network-object {object net_obj_name |
subnet_address netmask |
host ip_address} |
group-object grp_obj_name}
Example:
hostname(config)# object network Server1
hostname(config-network-object)# host
209.165.201.8
Configure the real destination addresses.
You can configure either a network object or a network object
group.
Although the main feature of twice NAT is the inclusion of the
destination IP address, the destination address is optional. If you
do specify the destination address, you can configure static
translation for that address or just use identity NAT for it. You
might want to configure twice NAT without a destination address
to take advantage of some of the other qualities of twice NAT,
including the use of network object groups for real addresses, or
manually ordering of rules. For more information, see the “Main
Differences Between Network Object NAT and Twice NAT”
section on page 29-16.
Step4 (Optional)
Network object:
object network obj_name
{host ip_address | subnet
subnet_address netmask | range
ip_address_1 ip_address_2}
Network object group:
object-group network grp_name
{network-object {object net_obj_name |
subnet_address netmask |
host ip_address} |
group-object grp_obj_name}
Example:
hostname(config)# object network
Server1_mapped
hostname(config-network-object)# host
10.1.1.67
Configure the mapped destination addresses.
The destination translation is always static. For identity NAT, you
can skip this step and simply use the same object or group for both
the real and mapped addresses.
If you want to translate the destination address, you can configure
either a network object or a network object group. The static
mapping is typically one-to-one, so the real addresses have the
same quantity as the mapped addresses. You can, however, have
different quantities if desired. For more information, see the
“Static NAT” section on page29-3.
For static interface NAT with port translation (routed mode only),
you can skip this step and specify the interface keyword instead
of a network object/group for the mapped address. For more
information, see the “Static Interface NAT with Port Translation”
section on page 29-5.
Command Purpose