Cisco ASA 5512-X Cli Configuration Guide

1-4
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring Network Object NAT
Configuring Network Object NAT
• Configuring Dynamic NAT, page 1-5
• Configuring Dynamic PAT (Hide), page 1-7
• Configuring Static NAT or Static NAT-with-Port-Translation, page 1-11
• Configuring Identity NAT, page 1-14
• Configuring Per-Session PAT Rules, page 1-16
Adding Network Objects for Mapped Addresses
For dynamic NAT, you must use an object or group for the mapped addresses. Other NAT types have the
option of using inline addresses, or you can create an object or group according to this section. For more
information about configuring a network object or group, see the “Configuring Network Objects and
Groups” section on page 1-2.
Guidelines
• A network object group can contain objects and/or inline addresses of either IPv4 or IPv6 addresses.
The group cannot contain both IPv4 and IPv6 addresses; it must contain one type only.
• See the “Guidelines and Limitations” section on page 1-2 for information about disallowed mapped
IP addresses.
• Dynamic NAT:
– You cannot use an inline address; you must configure a network object or group.
– The object or group cannot contain a subnet; the object must define a range; the group can
include hosts and ranges.
– If a mapped network object contains both ranges and host IP addresses, then the ranges are used
for dynamic NAT, and then the host IP addresses are used as a PAT fallback.
• Dynamic PAT (Hide):
– Instead of using an object, you can optionally configure an inline host address or specify the
interface address.
– If you use an object, the object or group cannot contain a subnet; the object must define a host,
or for a PAT pool, a range; the group (for a PAT pool) can include hosts and ranges.
• Static NAT or Static NAT with port translation:
– Instead of using an object, you can configure an inline address or specify the interface address
(for static NAT-with-port-translation).
– If you use an object, the object or group can contain a host, range, or subnet.
• Identity NAT
– Instead of using an object, you can configure an inline address.
– If you use an object, the object must match the real addresses you want to translate.

Cisco ASA 5512-X Specifications

General

Brand	Cisco
Model	ASA 5512-X
Category	Firewall
Language	English