31-9
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter31 Configuring Twice NAT
Configuring Twice NAT
•Many application inspections do not support extended PAT. See the “Default Settings” section on
page 42-4 in Chapter 42, “Getting Started with Application Layer Protocol Inspection,” for a
complete list of unsupported inspections.
•If you enable extended PAT for a dynamic PAT rule, then you cannot also use an address in the PAT
pool as the PAT address in a separate static NAT-with-port-translation rule. For example, if the PAT
pool includes 10.1.1.1, then you cannot create a static NAT-with-port-translation rule using 10.1.1.1
as the PAT address.
•If you use a PAT pool and specify an interface for fallback, you cannot specify extended PAT.
•For VoIP deployments that use ICE or TURN, do not use extended PAT. ICE and TURN rely on the
PAT binding to be the same for all destinations.
For round robin for a PAT pool:
•(8.4(3) and later, not including 8.5(1) or 8.6(1)) If a host has an existing connection, then subsequent
connections from that host will use the same PAT IP address if ports are available. Note: This
“stickiness” does not survive a failover. If the ASA fails over, then subsequent connections from a
host may not use the initial IP address.
•(8.4(2), 8.5(1), and 8.6(1)) If a host has an existing connection, then subsequent connections from
that host will likely use different PAT addresses for each connection because of the round robin
allocation. In this case, you may have problems when accessing two websites that exchange
information about the host, for example an e-commerce site and a payment site. When these sites
see two different IP addresses for what is supposed to be a single host, the transaction may fail.
•Round robin, especially when combined with extended PAT, can consume a large amount of
memory. Because NAT pools are created for every mapped protocol/IP address/port range, round
robin results in a large number of concurrent NAT pools, which use memory. Extended PAT results
in an even larger number of concurrent NAT pools.
Detailed Steps
Command Purpose
Step1 Network object:
object network obj_name
{host ip_address | subnet
subnet_address netmask | range
ip_address_1 ip_address_2}
Network object group:
object-group network grp_name
{network-object {object net_obj_name |
subnet_address netmask |
host ip_address} |
group-object grp_obj_name}
Example:
hostname(config)# object network MyInsNet
hostname(config-network-object)# subnet
10.1.1.0 255.255.255.0
Configure the real source addresses.
You can configure either a network object or a network object
group. For more information, see the “Configuring Objects”
section on page 13-3.
If you want to translate all traffic, you can skip this step and
specify the any keyword instead of creating an object or group.