5-19
Cisco ASA Series Firewall CLI Configuration Guide
Chapter5 Configuring Twice NAT
Configuring Twice NAT
Step3 nat [(real_ifc,mapped_ifc)]
[line |{after-object [line]}]
source static real_ob
[mapped_obj |interface [ipv6]]
[destination static {mapped_obj |
interface [ipv6]} real_obj]
[service real_src_mapped_dest_svc_obj
mapped_src_real_dest_svc_obj][net-to-net]
[dns] [unidirectional | no-proxy-arp]
[inactive] [description desc]
Example:
ciscoasa(config)# nat (inside,dmz) source
static MyInsNet MyInsNet_mapped
destination static Server1 Server1 service
REAL_SRC_SVC MAPPED_SRC_SVC
Configures static NAT. See the following guidelines:
•Interfaces—(Required for transparent mode) Specify the real
and mapped interfaces. Be sure to include the parentheses in
your command. In routed mode, if you do not specify the real
and mapped interfaces, all interfaces are used; you can also
specify the keyword any for one or both of the interfaces.
•Section and Line—(Optional) By default, the NAT rule is
added to the end of section 1 of the NAT table. See the “NAT
Rule Order” section on page3-18 for more information about
sections. If you want to add the rule into section 3 instead
(after the network object NAT rules), then use the after-auto
keyword. You can insert a rule anywhere in the applicable
section using the line argument.
•Source addresses:
–
Real—Specify a network object or group.
–
Mapped—Specify a different network object or group.
For static interface NAT with port translation only, you
can specify the interface keyword (routed mode only). If
you specify ipv6, then the IPv6 address of the interface
is used. If you specify interface, be sure to also configure
the service keyword (in this case, the service objects
should include only the source port). For this option, you
must configure a specific interface for the mapped_ifc.
See the “Static Interface NAT with Port Translation”
section on page 3-5 for more information.
•Destination addresses (Optional):
–
Mapped—Specify a network object or group, or for static
interface NAT with port translation only, specify the
interface keyword. If you specify ipv6, then the IPv6
address of the interface is used. If you specify interface,
be sure to also configure the service keyword (in this
case, the service objects should include only the
destination port). For this option, you must configure a
specific interface for the real_ifc.
–
Real—Specify a network object or group. For identity
NAT, simply use the same object or group for both the
real and mapped addresses.
Command Purpose