Cisco Systems Static PAT

35-9
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter35 Configuring NAT (ASA 8.2 and Earlier)
NAT Overview
The main difference between dynamic NAT and a range of addresses for static NAT is that static NAT
allows a remote host to initiate a connection to a translated host (if an access list exists that allows it),
while dynamic NAT does not. You also need an equal number of mapped addresses as real addresses with
static NAT.
Static PAT
Static PAT is the same as static NAT, except that it lets you specify the protocol (TCP or UDP) and port
for the real and mapped addresses.
This feature lets you identify the same mapped address across many different static statements, provided
the port is different for each statement. You cannot use the same mapped address for multiple static NAT
statements.
For applications that require inspection for secondary channels (for example, FTP and VoIP), the ASA
automatically translates the secondary ports.
For example, if you want to provide a single address for remote users to access FTP, HTTP, and SMTP,
but these are all actually different servers on the real network, you can specify static PAT statements for
each server that uses the same mapped IP address, but different ports (see Figure35-8).
Figure35-8 Static PAT
You can also use static PAT to translate a well-known port to a non-standard port or vice versa. For
example, if inside web servers use port 8080, you can allow outside users to connect to port 80, and then
undo translation to the original port 8080. Similarly, to provide extra security, you can tell web users to
connect to non-standard port 6785, and then undo translation to port 80.
Host
Outside
Inside
Undo Translation
10.1.2.27209.165.201.3:21
Undo Translation
10.1.2.28209.165.201.3:80
Undo Translation
10.1.2.29209.165.201.3:25
FTP server
10.1.2.27
HTTP server
10.1.2.28
SMTP server
10.1.2.29
130031