Cisco Systems ASA5515K9, ASA 5500 - page 613

31-7
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter31 Configuring Twice NAT
Configuring Twice NAT
Step6 nat [(real_ifc,mapped_ifc)]
[line |{after-auto [line]}]
source dynamic {real_obj | any}
{mapped_obj [interface]}
[destination static {mapped_obj |
interface} real_obj]
[service mapped_dest_svc_obj
real_dest_svc_obj] [dns] [inactive]
[description desc]
Example:
hostname(config)# nat (inside,outside)
source dynamic MyInsNet NAT_POOL
destination static Server1_mapped Server1
service MAPPED_SVC REAL_SVC
Configure dynamic NAT. See the following guidelines:
•Interfaces—(Required for transparent mode) Specify the real
and mapped interfaces. Be sure to include the parentheses in
your command. In routed mode, if you do not specify the real
and mapped interfaces, all interfaces are used; you can also
specify the keyword any for one or both of the interfaces.
•Section and Line—(Optional) By default, the NAT rule is
added to the end of section 1 of the NAT table (see the “NAT
Rule Order” section on page29-20). If you want to add the
rule into section 3 instead (after the network object NAT
rules), then use the after-auto keyword. You can insert a rule
anywhere in the applicable section using the line argument.
•Source addresses:
– Real—Specify a network object, group, or the any
keyword (see Step1). Use the any key word if you want
to translate all traffic from the real interface to the
mapped interface.
– Mapped—Specify a different network object or group
(see Step2). You can optionally configure the following
fallback method:
Interface PAT fallback—(Routed mode only) The
interface keyword enables interface PAT fallback. After
the mapped IP addresses are used up, then the IP address
of the mapped interface is used. For this option, you must
configure a specific interface for the mapped_ifc.
Command Purpose