Cisco Systems ASA5515K9, ASA 5500 - page 616

31-10
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter31 Configuring Twice NAT
Configuring Twice NAT
Step2 Network object:
object network obj_name
{host ip_address | range ip_address_1
ip_address_2}
Network object group:
object-group network grp_name
{network-object {object net_obj_name |
host ip_address} |
group-object grp_obj_name}
Example:
hostname(config)# object network PAT_POOL1
hostname(config-network-object)# range
10.5.1.80 10.7.1.80
hostname(config)# object network PAT_POOL2
hostname(config-network-object)# range
10.9.1.1 10.10.1.1
hostname(config)# object network PAT_IP
hostname(config-network-object)# host
10.5.1.79
hostname(config-network-object)#
object-group network PAT_POOLS
hostname(config-network)# network-object
object PAT_POOL1
hostname(config-network)# network-object
object PAT_POOL2
hostname(config-network)# network-object
object PAT_IP
Specify the mapped address(es) (that you want to translate to).
You can configure a single address or, for a PAT pool, multiple
addresses. Configure a network object or network object group. A
network object group can contain objects and/or inline addresses.
Alternatively, you can skip this step if you want to enter a single
IP address as an inline value for the nat command or if you want
to use the interface address by specifying the interface keyword.
For mapped addresses used as a PAT pool, all addresses in the
object or group, including ranges, are used as PAT addresses.
Note The object or group cannot contain a subnet.
See the “Guidelines and Limitations” section on page31-2 for
information about disallowed mapped IP addresses.
For more information about configuring a network object or
group, see the “Configuring Objects” section on page13-3.
Step3 (Optional)
Network object:
object network obj_name
{host ip_address | subnet
subnet_address netmask | range
ip_address_1 ip_address_2}
Network object group:
object-group network grp_name
{network-object {object net_obj_name |
subnet_address netmask |
host ip_address} |
group-object grp_obj_name}
Example:
hostname(config)# object network Server1
hostname(config-network-object)# host
209.165.201.8
Configure the real destination addresses.
You can configure either a network object or a network object
group.
Although the main feature of twice NAT is the inclusion of the
destination IP address, the destination address is optional. If you
do specify the destination address, you can configure static
translation for that address or just use identity NAT for it. You
might want to configure twice NAT without a destination address
to take advantage of some of the other qualities of twice NAT,
including the use of network object groups for real addresses, or
manually ordering of rules. For more information, see the “Main
Differences Between Network Object NAT and Twice NAT”
section on page 29-16.
Command Purpose