Cisco Systems Configuring Identity NAT

5-21
Cisco ASA Series Firewall CLI Configuration Guide
Chapter5 Configuring Twice NAT
Configuring Twice NAT
to the command keywords; the actual source and destination address and port in a packet depends on
which host sent the packet. In this example, connections are originated from outside to inside, so the
“source” address and port of the FTP server is actually the destination address and port in the originating
packet.
ciscoasa(config)# object service FTP_PASV_PORT_RANGE
ciscoasa(config-service-object)# service tcp source range 65000 65004
ciscoasa(config)# object network HOST_FTP_SERVER
ciscoasa(config-network-object)# host 192.168.10.100
ciscoasa(config)# nat (inside,outside) source static HOST_FTP_SERVER interface service
FTP_PASV_PORT_RANGE FTP_PASV_PORT_RANGE
The following example shows a static translation of one IPv6 network to another IPv6 when accessing
an IPv6 network, and the dynamic PAT translation to an IPv4 PAT pool when accessing the IPv4 network:
ciscoasa(config)# object network INSIDE_NW
ciscoasa(config-network-object)# subnet 2001:DB8:AAAA::/96
ciscoasa(config)# object network MAPPED_IPv6_NW
ciscoasa(config-network-object)# subnet 2001:DB8:BBBB::/96
ciscoasa(config)# object network OUTSIDE_IPv6_NW
ciscoasa(config-network-object)# subnet 2001:DB8:CCCC::/96
ciscoasa(config)# object network OUTSIDE_IPv4_NW
ciscoasa(config-network-object)# subnet 10.1.1.0 255.255.255.0
ciscoasa(config)# object network MAPPED_IPv4_POOL
ciscoasa(config-network-object)# range 10.1.2.1 10.1.2.254
ciscoasa(config)# nat (inside,outside) source static INSIDE_NW MAPPED_IPv6_NW destination
static OUTSIDE_IPv6_NW OUTSIDE_IPv6_NW
ciscoasa(config)# nat (inside,outside) source dynamic INSIDE_NW pat-pool MAPPED_IPv4_POOL
destination static OUTSIDE_IPv4_NW OUTSIDE_IPv4_NW
Configuring Identity NAT
This section describes how to configure an identity NAT rule using twice NAT. For more information
about identity NAT, see the “Identity NAT” section on page3-10.