Cisco Systems Policy NAT

6-11
Cisco ASA Series Firewall ASDM Configuration Guide
Chapter6 Configuring NAT (ASA 8.2 and Earlier)
NAT Overview
the other hand, lets you specify a particular interface on which to translate the addresses. Make sure
that the real addresses for which you use identity NAT are routable on all networks that are available
according to your ACLs.
For identity NAT, even though the mapped address is the same as the real address, you cannot initiate
a connection from the outside to the inside (even if the interface ACL allows it). Use static identity
NAT or NAT exemption for this functionality.
•Static identity NAT—Static identity NAT lets you specify the interface on which you want to allow
the real addresses to appear, so you can use identity NAT when you access interfaceA, and use
regular translation when you access interface B. Static identity NAT also lets you use policy NAT,
which identifies the real and destination addresses when determining the real addresses to translate
(see the “Policy NAT” section on page6-11 for more information about policy NAT). For example,
you can use static identity NAT for an inside address when it accesses the outside interface and the
destination is server A, but use a normal translation when accessing the outside server B.
•NAT exemption—NAT exemption allows both translated and remote hosts to initiate connections.
Like identity NAT, you do not limit translation for a host on specific interfaces; you must use NAT
exemption for connections through all interfaces. However, NATexemption does let you specify the
real and destination addresses when determining the real addresses to translate (similar to policy
NAT), so you have greater control using NAT exemption. However unlike policy NAT, NAT
exemption does not consider the ports in theACL. NAT exemption also does not let you configure
connection limits such as maximum TCP connections.
Policy NAT
Policy NAT lets you identify real addresses for address translation by specifying the source and
destination addresses. You can also optionally specify the source and destination ports. Regular NAT can
only consider the source addresses, and not the destination. For example, with policy NAT, you can
translate the real address to mapped address A when it accesses server A, but translate the real address
to mapped address B when it accesses server B.
For applications that require application inspection for secondary channels (for example, FTP and VoIP),
the policy specified in the policy NAT rule should include the secondary ports. When the ports cannot
be predicted, the policy should specify only the IP addresses for the secondary channel. With this
configuration, the security appliance translates the secondary ports.
Figure 6-9 shows a host on the 10.1.2.0/24 network accessing two different servers. When the host
accesses the server at 209.165.201.11, the real address is translated to 209.165.202.129. When the host
accesses the server at 209.165.200.225, the real address is translated to 209.165.202.130. Consequently,
the host appears to be on the same network as the servers, which can help with routing.