Cisco Systems OL-16647-01 Configuring NAT Control

21-15
Cisco ASDM User Guide
OL-16647-01
Chapter 21 Configuring NAT
Configuring NAT Control
Figure 21-13 shows a web server and DNS server on the outside. The security appliance has a static
translation for the outside server. In this case, when an inside user requests the address for ftp.cisco.com
from the DNS server, the DNS server responds with the real address, 209.165.20.10. Because you want
inside users to use the mapped address for ftp.cisco.com (10.1.2.56) you need to configure DNS reply
modification for the static translation.
Figure 21-13 DNS Reply Modification Using Outside NAT
Configuring NAT Control
NAT control requires that packets traversing from an inside interface to an outside interface match a NAT
rule. See the “NAT Control” section on page 21-4 for more information.
To enable NAT control, on the Configuration > Firewall > NAT Rules pane, check Enable traffic
through the firewall without address translation.
ftp.cisco.com
209.165.201.10
DNS Server
Outside
Inside
User
10.1.2.27
Static Translation on Inside to:
10.1.2.56
130022
1
2
7
6
5
4
3
DNS Query
ftp.cisco.com?
DNS Reply
209.165.201.10
DNS Reply Modification
209.165.201.10 10.1.2.56
DNS Reply
10.1.2.56
FTP Request
209.165.201.10
Dest Addr. Translation
209.165.201.1010.1.2.56
FTP Request
10.1.2.56
Security
Appliance