5-20
Cisco ASA Series Firewall CLI Configuration Guide
Chapter5 Configuring Twice NAT
Configuring Twice NAT
Examples
The following example shows the use of static interface NAT with port translation. Hosts on the outside
access an FTP server on the inside by connecting to the outside interface IP address with destination port
65000 through 65004. The traffic is untranslated to the internal FTP server at 192.168.10.100:6500
through :65004. Note that you specify the source port range in the service object (and not the destination
port) because you want to translate the source address and port as identified in the command; the
destination port is “any.” Because static NAT is bidirectional, “source” and “destination” refers primarily
(Continued)
•Ports—(Optional) Specify the service keyword along with
the real and mapped service objects. For source port
translation, the objects must specify the source service. The
order of the service objects in the command for source port
translation is service real_obj mapped_obj. For destination
port translation, the objects must specify the destination
service. The order of the service objects for destination port
translation is service mapped_obj real_obj. In the rare case
where you specify both the source and destination ports in the
object, the first service object contains the real source
port/mapped destination port; the second service object
contains the mapped source port/real destination port. For
identity port translation, simply use the same service object
for both the real and mapped ports (source and/or destination
ports, depending on your configuration).
•Net-to-net—(Optional) For NAT 46, specify net-to-net to
translate the first IPv4 address to the first IPv6 address, the
second to the second, and so on. Without this option, the
IPv4-embedded method is used. For a one-to-one translation,
you must use this keyword.
•DNS—(Optional; for a source-only rule) The dns keyword
translates DNS replies. Be sure DNS inspection is enabled (it
is enabled by default). You cannot configure the dns keyword
if you configure a destination address. See the “DNS and
NAT” section on page3-28 for more information.
•Unidirectional—(Optional) Specify unidirectional so the
destination addresses cannot initiate traffic to the source
addresses.
•No Proxy ARP—(Optional) Specify no-proxy-arp to disable
proxy ARP for incoming packets to the mapped IP addresses.
See the “Mapped Addresses and Routing” section on
page 3-20 for more information.
•Inactive—(Optional) To make this rule inactive without
having to remove the command, use the inactive keyword. To
reactivate it, reenter the whole command without the inactive
keyword.
•Description—(Optional) Provide a description up to 200
characters using the description keyword.
Command Purpose