6-6
Cisco ASA Series Firewall ASDM Configuration Guide
Chapter6 Configuring NAT (ASA 8.2 and Earlier)
NAT Overview
NAT Types
This section describes the available NAT types, and includes the following topics:
•Dynamic NAT, page6-6
•PAT, page 6-8
•Static NAT, page6-9
•Static PAT, page 6-9
•Bypassing NAT When NAT Control is Enabled, page6-10
You can implement address translation as dynamic NAT, Port Address Translation, static NAT, static
PAT, or as a mix of these types. You can also configure rules to bypass NAT; for example, to enable NAT
control when you do not want to perform NAT.

Dynamic NAT

Dynamic NAT translates a group of real addresses to a pool of mapped addresses that are routable on the
destination network. The mapped pool may include fewer addresses than the real group. When a host
you want to translate accesses the destination network, the ASA assigns the host an IP address from the
mapped pool. The translation is added only when the real host initiates the connection. The translation
is in place only for the duration of the connection, and a given user does not keep the same IPaddress
after the translation times out. Users on the destination network, therefore, cannot initiate a reliable
connection to a host that uses dynamic NAT, although the connection is allowed by an ACL, and the ASA
rejects any attempt to connect to a real host address directly. See the “Static NAT” or “Static PAT”
section for information on how to obtain reliable access to hosts.
Note In some cases, a translation is added for a connection, although the session is denied by the ASA. This
condition occurs with an outbound ACL, a management-only interface, or a backup interface in which
the translation times out normally.
Figure 6-6 shows a remote host attempting to connect to the real address. The connection is denied,
because the ASA only allows returning connections to the mapped address.