Cisco Systems Monitoring Twice NAT

5-24
Cisco ASA Series Firewall CLI Configuration Guide
Chapter5 Configuring Twice NAT
Monitoring Twice NAT
Configuring Per-Session PAT Rules
By default, all TCP PAT traffic and all UDP DNS traffic uses per-session PAT. To use multi-session PAT
for traffic, you can configure per-session PAT rules: a permit rule uses per-session PAT, and a deny rule
uses multi-session PAT. For more information about per-session vs. multi-session PAT, see the
“Per-Session PAT vs. Multi-Session PAT” section on page3-9.
Detailed Steps
To configure a per-session PAT rule, see the “Configuring Per-Session PAT Rules” section on page4-16.
Monitoring Twice NAT
To monitor twice NAT, enter one of the following commands:
(Continued)
•No Proxy ARP—(Optional) Specify no-proxy-arp to disable
proxy ARP for incoming packets to the mapped IP addresses.
See the “Mapped Addresses and Routing” section on
page 3-20 for more information.
•Route lookup—(Optional; routed mode only; interface(s)
specified) Specify route-lookup to determine the egress
interface using a route lookup instead of using the interface
specified in the NAT command. See the “Determining the
Egress Interface” section on page3-22 for more information.
•Inactive—(Optional) To make this rule inactive without
having to remove the command, use the inactive keyword. To
reactivate it, reenter the whole command without the inactive
keyword.
•Description—(Optional) Provide a description up to 200
characters using the description keyword.
Command Purpose
Command Purpose
show nat Shows NAT statistics, including hits for each NAT rule.
show nat pool Shows NAT pool statistics, including the addresses and ports allocated,
and how many times they were allocated.
show xlate Shows current NAT session information.
show nat divert-table All NAT rules build an entry in the NAT divert table. If the NAT divert
field is set to ignore=yes NAT on the matching rule, the ASA stops the
lookup and does a route lookup based on the destination IP to determine
the egress interface. If the NAT divert field is set to ignore=no on the
matching rule, walk the NAT table based on the found input_ifc and
output_ifc and do the necessary translation. Egress interface will be
output_ifc.