NAT Order of Operations 82

Network Address Translation (NAT)
Objective:
Understand how the different types of NAT work, to ensure the capability to properly configure
them and troubleshoot any problem related.
Introduction to NAT
Address translation substitutes the real address in a packet with a mapped address that is routable
on the destination network. NAT is composed of two steps: the process by which a real address is
translated into a mapped address and the process to undo translation for returning traffic.
ASAs:
The adaptive security appliance translates an address when a NAT rule matches the traffic. If no
NAT rule matches, processing for the packet continues. The exception is when you enable NAT
control. NAT control requires that packets traversing from a higher security interface (inside) to a
lower security interface (outside) match a NAT rule, or processing for the packet stops.
NAT Types
You can implement address translation as dynamic NAT, Port Address Translation (PAT), static
NAT, static PAT, or as a mix of these types. You can also configure rules to bypass NAT; for
example, to enable NAT control when you do not want to perform NAT.
The following translation types are available:
Dynamic NATDynamic NAT translates a group of real addresses to a pool of mapped
addresses that are routable on the destination network.
PATPAT translates multiple real addresses to a single mapped IP address.
Static NATStatic NAT creates a fixed translation of real addresses to mapped addresses.
With dynamic NAT and PAT, each host uses a different address or port for each subsequent
translation.
Static PATStatic PAT is the same as static NAT, except that it enables you to specify the
protocol and port for the real and mapped addresses.
If you enable NAT control, then inside hosts must match a NAT rule when accessing outside
hosts. If you do not want to perform NAT for some hosts, then you can bypass NAT for those
hosts, or you can disable NAT control.
NAT order of operation

The adaptive security appliance matches real addresses to NAT commands in the following
order:
1. NAT exemption (nat 0 access-list)In order, until the first match. Identity NAT is not
included in this category; it is included in the regular static NAT or regular NAT category. We do
not recommend overlapping addresses in NAT exemption statements because unexpected results
can occur.
2.
Match against existing xlates
You need to confirm that there are no existing xlate up, if there are any related to the connection
directed to the destination network 172.168.1.0/24 from the 192.168.1.0/24 you will need to
clear the translation table.
Options to clear translation table:
clear local
clear xlate
3. Static command:
a) Static nat with and without access-list (first match)
Static NAT is read from top to bottom, meaning that if you have two static NATs the first line is
read before the second line is taken in consideration.
Example:
Static (inside,outside) 10.198.28.9 192.168.1.2 netmask 255.255.255.255
As you can see on this output 192.168.1.2 is translated to 10.198.28.9 and then 192.168.1.0/24 is
translated to itself:
ASA(config)# show xlate debug | in NAT
NAT from inside:192.168.1.2 to outside:10.198.28.9 flags s idle 0:00:16 timeout
0:00:00
NAT from inside:192.168.1.3 to outside:10.198.28.8 flags s idle 0:00:16 timeout
0:00:00
What would happen if I put the identity static NAT for the network first and then the most
specific line??
Here is the output that you would get when you put in the 3 static NAT entries:
static (inside,outside) 10.198.28.0 192.168.1.0 netmask 255.255.255.0
WARNING: mapped-address conflict with existing static
inside:192.168.1.0 to outside:10.198.28.0 netmask 255.255.255.0
WARNING: real-address conflict with existing static
WARNING: mapped-address conflict with existing static
WARNING: real-address conflict with existing static
The show xlate detail | in NAT indicates the next:
NAT from inside:192.168.1.0 to outside:10.198.28.0 flags s
-
If you simulate a packet destine to 10.198.28.3 from the 172.168.1.2 you can see that the
packet will be sent to 192.168.1.3:
ciscoasa(config)# packet-tracer input outside tcp 172.168.1.2 1025 10.198.28.3 80

Phase: 1
Type: FLOW-LOOKUP
Subtype:
Result: ALLOW
Config:
Additional Information:
Found no matching flow, creating a new flow
Phase: 2
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
match ip inside 192.168.1.0 255.255.255.0 outside any
static translation to 10.198.28.0
translate_hits = 0, untranslate_hits = 216
NAT divert to egress interface inside
Untranslate 10.198.28.0/0 to 192.168.1.0/0 using netmask 255.255.255.0
Phase: 3
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group inbound in interface outside
access-list inbound extended permit ip any any
Forward Flow based lookup yields rule:
in id=0xb1f27018, priority=12, domain=permit, deny=false
hits=154, user_data=0xaecdda80, cs_id=0x0, flags=0x0, protocol=0
src ip=0.0.0.0, mask=0.0.0.0, port=0
dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
Phase: 4
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
in id=0xb1fc76a8, priority=0, domain=permit-ip-option, deny=true
hits=154, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip=0.0.0.0, mask=0.0.0.0, port=0
Phase: 5
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
out id=0xb1c02728, priority=5, domain=nat-reverse, deny=false
hits=154, user_data=0xb1f377e8, cs_id=0x0, flags=0x0, protocol=0
src ip=0.0.0.0, mask=0.0.0.0, port=0
Phase: 6
Type: NAT
Subtype: host-limits
Result: ALLOW
Config:
Reverse Flow based lookup yields rule:
in id=0xb1c027c0, priority=5, domain=host, deny=false
hits=163, user_data=0xb1f377e8, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip=192.168.1.0, mask=255.255.255.0, port=0
Phase: 7
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
in id=0xb1f3cdb0, priority=0, domain=permit-ip-option, deny=true
src ip=0.0.0.0, mask=0.0.0.0, port=0
Phase: 8
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
New flow created with id 203, packet dispatched to next module
Module information for forward flow ...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_tcp_normalizer
snp_fp_translate
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat
Module information for reverse flow ...
snp_fp_tracer_drop
snp_fp_translate
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat
Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: inside
output-status: up
output-line-status: up
Action: allow
Here is the log:
ASA-6-302013: Built inbound TCP connection 103 for outside:172.168.1.2/1025
(172.168.1.2/1025) to inside:192.168.1.3/80 (10.198.28.3/80)
-
packet will be sent to 192.168.1.8 and not to 192.168.1.3:
Phase: 1
Type: FLOW-LOOKUP
Subtype:
Result: ALLOW
Config:
Phase: 2
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
Phase: 3
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
in id=0xb1f27018, priority=12, domain=permit, deny=false
hits=106, user_data=0xaecdda80, cs_id=0x0, flags=0x0, protocol=0
src ip=0.0.0.0, mask=0.0.0.0, port=0
Phase: 4
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
in id=0xb1fc76a8, priority=0, domain=permit-ip-option, deny=true
src ip=0.0.0.0, mask=0.0.0.0, port=0
Phase: 5
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:

out id=0xb1c02728, priority=5, domain=nat-reverse, deny=false
hits=106, user_data=0xb1f377e8, cs_id=0x0, flags=0x0, protocol=0
src ip=0.0.0.0, mask=0.0.0.0, port=0
Phase: 6
Type: NAT
Result: ALLOW
Config:
in id=0xb1c027c0, priority=5, domain=host, deny=false
hits=128, user_data=0xb1f377e8, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip=192.168.1.0, mask=255.255.255.0, port=0
Phase: 7
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
in id=0xb1f3cdb0, priority=0, domain=permit-ip-option, deny=true
src ip=0.0.0.0, mask=0.0.0.0, port=0
Phase: 8
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Module information for forward flow ...
snp_fp_tracer_drop
snp_fp_translate
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat
Module information for reverse flow ...
snp_fp_tracer_drop
snp_fp_translate
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat
Result:
input-status: up
output-status: up
Action: allow
Here is the log:
%ASA-6-302013: Built inbound TCP connection 155 for outside:172.168.1.2/1025
(172.168.1.2/1025) to inside:192.168.1.8/80 (10.198.28.8/80)
Although it is strongly suggested to not use the next static NAT:
You can configure it but it would be set as the last static in the configuration so it would not
conflict with the unpaired statics that are already configured.
As you can see no Warnings or errors are displayed.
The "show xlate detail | in NAT" would display the next:

With the correct configuration you will see how packets are directed to the correct address:
If you simulate a packet destine to 10.198.28.3 from the 172.168.1.2 you can see that the packet
will be sent to 192.168.1.3:
Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
MAC Access list
Phase: 2
Type: FLOW-LOOKUP
Subtype:
Result: ALLOW
Config:
Phase: 3
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
Phase: 4
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
Phase: 5
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Phase: 6
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
match ip inside host 192.168.1.3 outside any
Phase: 7
Type: NAT
Result: ALLOW
Config:
Phase: 8
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Phase: 9
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Result:
input-status: up
output-status: up
Action: allow
ciscoasa(config)#
Here is the log:
(172.168.1.2/1025) to inside:192.168.1.3/80 (10.198.28.3/80)
-
packet will be sent to 192.168.1.3:

Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
MAC Access list
Phase: 2
Type: FLOW-LOOKUP
Subtype:
Result: ALLOW
Config:
Phase: 3
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
Phase: 4
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
Phase: 5
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Phase: 6
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
Phase: 7
Type: NAT
Result: ALLOW
Config:
Phase: 8
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Phase: 9
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Result:
input-status: up
output-status: up
Action: allow
Here is the log:
(172.168.1.2/1025) to inside:192.168.1.3/80 (10.198.28.8/80)
>>>>> What we are trying to explain here is that the order does affect the end result, so order
does affect NAT in any code that is under 8.3.
Here is an example of static NAT with access-list (Policy NAT):
- First you identify the traffic that you wish to NAT:
access-list 110 permit ip 192.168.1.0 255.255.255.0 172.168.1.0 255.255.255.0
access-list 111 permit ip host 192.168.1.2 any
- Second, configure the static with the global IP and then add the respective ACL so the criteria is
matched.
Static (inside,outside) 192.168.1.0 access-list 110
Static (inside,outside) 10.198.28.9 access-list 111
The show xlate detail | in NAT indicates the next:
GayASA(config)# show xlate detail | in NAT
NAT from inside:192.168.1.0 to outside(110):192.168.1.0 flags s

NAT from inside:192.168.1.2 to outside(111):10.198.28.9 flags s
Note: When you configure the ACLs for policy static NAT you must define IP, you cannot define
protcol or port in this ACL.
b) Static pat with and without access-list (first match)
On static PAT you can define two types of protocols and over 65000 ports per protocol.
Here is an example of static PAT:
static (inside,outside) tcp 10.198.28.9 3389 192.168.1.2 3389 netmask 255.255.255.255
ASA(config)# show xlate detail | in PAT
TCP PAT from inside:192.168.1.2/3389 to outside:10.198.28.9/3389 flags sr
Here is an example of static policy PAT:
GayASA(config)# access-list 110 permit tcp host 192.168.1.3 eq 80 any
GayASA(config)# static (inside,outside) tcp interface 80 access-list 110
GayASA(config)# show xlate detail | in PAT
TCP PAT from inside:192.168.1.3/80 to outside(110):10.198.28.14/80 flags sr
Note: When you configure the ACLs for policy static PAT you must define the protocol (TCP or
UDP), you must also define protcol and port in this ACL.
4. Nat
a) nat <id> access-list (first match)
Note: nat 0 access-list is not part of this command.
b) nat <id> <address> <mask> (best match)
Note: When choosing a global address from multiple pools with
the same nat id, the following order is tried
i) if the id is 0, create an identity xlate.
ii) use the global pool for dynamic NAT
iii) use the global pool for dynamic PAT
Configurations:
NAT control
Information about NAT Control:
-
NAT Control and Inside Interfaces
NAT control requires that packets traversing from an inside interface to an outside interface
match a NAT rule; for any host on the inside network to access a host on the outside network,
you must configure NAT to translate the inside host address
- NAT Control and Same Security Interfaces
Interfaces at the same security level are not required to use NAT to communicate. However, if
you configure dynamic NAT or PAT on a same security interface, then all traffic from the
interface to a same security interface or an outside interface must match a NAT rule
- NAT Control and Outside Dynamic NAT
Similarly, if you enable outside dynamic NAT or PAT, then all outside traffic must match a NAT
rule when it accesses an inside interface.
- NAT Control and Static NAT
NAT control does not affect static NAT and does not cause the restrictions seen with dynamic
NAT.
Configuring NAT Control

To enable NAT control, enter the following command:
Command
nat-control
Purpose
Enables NAT control.
To disable NAT control, enter the no form of the
command.
Example:
hostname(config)# natcontrol
Static NAT
Information about Static NAT
Static NAT creates a fixed translation of real address(es) to mapped address(es).
The main difference between dynamic NAT and a range of addresses for static NAT is that
static NAT allows a remote host to initiate a connection to a translated host (if an access list
exists that allows it), while dynamic NAT does not. You also need an equal number of mapped
addresses as real addresses with static NAT.
Configuring Policy Static NAT

Configures a persistent one-to-one address translation rule by mapping a real IP address
to a mapped IP address.
Identify the real addresses and destination/source addresses using an extended access list.
Create the extended access list using the access-list extended command. The first address
in the access list is the real address; the second address is either the source or destination
address, depending on where the traffic originates.
Example:
To translate the real address 10.1.1.1 to the mapped address 192.168.1.1 when 10.1.1.1 sends
traffic to the 209.165.200.224 network, the access-list and static commands are as follows:
hostname(config)# access-list TEST extended permit ip host 10.1.1.1 209.165.200.224
255.255.255.224
hostname(config)# static (inside,outside) 192.168.1.1 access-list TEST
- In this case, the second address is the destination address. However, the same
configuration is used for hosts to originate a connection to the mapped address. For
example, when a host on the 209.165.200.224/27 network initiates a connection to
192.168.1.1, then the second address in the access list is the source address.
-
If you specify a network for translation (for example, 10.1.1.0 255.255.255.0), then the
adaptive security appliance translates the .0 and .255 addresses. If you want to prevent
access to these addresses, be sure to configure an access list to deny access.
Configuring Regular Static NAT

Configures a persistent one-to-one address translation rule by mapping a real IP address
to a mapped IP address.
The following command maps an inside IP address (10.1.1.3) to an outside IP address

(209.165.201.12):
hostname(config)# static (inside,outside) 209.165.201.12 10.1.1.3 netmask 255.255.255.255
-
The following command maps the outside address (209.165.201.15) to an inside address
(10.1.1.6):
hostname(config)# static (outside,inside) 10.1.1.6 209.165.201.15 netmask 255.255.255.255
- The following command statically maps an entire subnet:
hostname(config)# static (inside,dmz) 10.1.1.0 10.1.2.0 netmask 255.255.255.0
Overlapping Networks
Two networks use an overlapping address space (192.168.100.0/24), but hosts on each network
must communicate (as allowed by access lists). Without NAT, when a host on the inside network
tries to access a host on the overlapping DMZ network, the packet never makes it past the
adaptive security appliance, which sees the packet as having a destination address on the inside
network. Moreover, if the destination address is being used by another host on the inside
network, that host receives the packet.
Step 1 Translate 192.168.100.0/24 on the inside to 10.1.2.0/24 when it accesses the DMZ by
entering the following command:
Step 2 Translate the 192.168.100.0/24 network on the DMZ to 10.1.3.0/24 when it accesses the
inside by entering the following command:
hostname(config)# static (dmz,inside) 10.1.3.0 192.168.100.0 netmask 255.255.255.0
Step 3 Configure the following static routes so that traffic to the dmz network can be routed
correctly by the adaptive security appliance:
hostname(config)# route dmz 192.168.100.128 255.255.255.128 10.1.1.2 1

hostname(config)# route dmz 192.168.100.0 255.255.255.128 10.1.1.2 1
The adaptive security appliance already has a connected route for the inside network. These
static routes allow the adaptive security appliance to send traffic for the 192.168.100.0/24
network out the DMZ interface to the gateway router at 10.1.1.2. (You need to split the network
into two because you cannot create a static route with the exact same network as a connected
route.) Alternatively, you could use a more broad route for the DMZ traffic, such as a default
route.
If host 192.168.100.2 on the DMZ network wants to initiate a connection to host 192.168.100.2
on the inside network, the following events occur:
1. The DMZ host 192.168.100.2 sends the packet to IP address 10.1.2.2.
2. When the adaptive security appliance receives this packet, the adaptive security appliance
translates the source address from 192.168.100.2 to 10.1.3.2.
3. Then the adaptive security appliance translates the destination address from 10.1.2.2 to
192.168.100.2, and the packet is forwarded.
Port Redirection (Forwarding) with Statics

Example of Redirecting Ports
static (inside,outside) tcp 172.18.124.99 telnet 10.1.1.6 telnet netmask 255.255.255.255 0 0

static (inside,outside) tcp 172.18.124.99 ftp 10.1.1.3 ftp netmask 255.255.255.255 0 0
static (inside,outside) tcp 172.18.124.208 telnet 10.1.1.4 telnet netmask 255.255.255.255 0 0
static (inside,outside) tcp interface telnet 10.1.1.5 telnet netmask 255.255.255.255 0 0
static (inside,outside) tcp interface www 10.1.1.5 www netmask 255.255.255.255 0 0
static (inside,outside) tcp 172.18.124.208 8080 10.1.1.7 www netmask 255.255.255.255 0 0
Static PAT
Information about Static PAT
Static PAT is the same as static NAT, except that it enables you to specify the protocol (TCP or
UDP) and port for the real and mapped addresses. Static PAT enables you to identify the same
mapped address across many different static statements, provided that the port is different for
each statement. You cannot use the same mapped address for multiple static NAT statements.
You can also use static PAT to translate a well-known port to a non-standard port or vice versa.
For example, if inside web servers use port 8080, you can allow outside users to connect to port
80, and then undo translation to the original port 8080. Similarly, to provide extra security, you
can tell web users to connect to non-standard port 6785, and then undo translation to port 80.
Configuring Static PAT

Policy Static PAT
- Enables you to reference a route map to identify specific conditions or policies that
trigger a static translation.
Example:
For Telnet traffic initiated from hosts on the 10.1.3.0 network to the adaptive security appliance
outside interface (10.1.2.14), you can redirect the traffic to the inside host at 10.1.1.15 by
entering the following commands:
hostname(config)# access-list TELNET permit tcp host 10.1.1.15 eq telnet 10.1.3.0
255.255.255.0
hostname(config)# static (inside,outside) tcp 10.1.2.14 telnet access-list TELNET
Regular Static PAT

- Static PAT translations allow a specific UDP or TCP port on a global address to be
translated to a specific port on a local address.
Example:
To redirect Telnet traffic from the adaptive security appliance outside interface (10.1.2.14) to the
inside host at 10.1.1.15, enter the following command:
hostname(config)# static (inside,outside) tcp 10.1.2.14 telnet 10.1.1.15 telnet netmask
255.255.255.255
Bypassing NAT
You might want to bypass NAT when you enable NAT control so that local IP addresses appear
untranslated. You also might want to bypass NAT if you are using an application that does not
support NAT.
You can bypass NAT using identity NAT, static identity NAT, or NAT exemption.
Identity NAT
Information about Identity NAT
Identity NAT translates the real IP address to the same IP address. Only "translated" hosts can
create NAT translations, and responding traffic is allowed back.
When you configure identity NAT (which is similar to dynamic NAT), you do not limit
translation for a host on specific interfaces; you must use identity NAT for connections through
all interfaces. For example, you cannot choose to perform normal translation on real addresses
when you access interface A and then use identity NAT when accessing interface B. Because you
use identity NAT for all connections through all interfaces, make sure that the real addresses for
which you use identity NAT are routable on all networks that are available according to your
access list.
-
For identity NAT, even though the mapped address is the same as the real address, you
cannot initiate a connection from the outside to the inside (even if the interface access list
allows it). Use static identity NAT or NAT exemption for this functionality.
You can clear the translation table using the clear xlate command
hostname(config)# nat (inside) 0 10.1.1.0 255.255.255.0
Static Identity NAT

Information about Static Identity NAT
Static identity NAT translates the real IP address to the same IP address. Static identity NAT
enables you to specify the interface on which you want to allow the real addresses to appear, so
you can use identity NAT when you access interface A, and use regular translation when you
access interface B. Static identity NAT also enables you to use policy NAT, which identifies the
real and destination addresses when determining the real addresses to translate.
For example, you can use static identity NAT for an inside address when it accesses the outside
interface and the destination is server A, but you can use a normal translation when accessing the
outside server B. The translation is always active, and both "translated" and remote hosts can
originate connections.
-
You cannot clear static translations from the translation table with the clear xlate
command; you must remove the static command instead.
Configuring Policy Static Identity NAT
The following policy static identity NAT example shows a single real address that uses identity
NAT when accessing one destination address and a translation when accessing another:
hostname(config)# access-list NET1 permit ip host 10.1.2.27 209.165.201.0 255.255.255.224
hostname(config)# access-list NET2 permit ip host 10.1.2.27 209.165.200.224
255.255.255.224
hostname(config)# static (inside,outside) 209.165.202.129 access-list NET1
hostname(config)# static (inside,outside) 209.165.202.130 access-list NET2
Configuring Regular Static Identity NAT
-
The following command uses static identity NAT for an inside IP address (10.1.1.3) when
accessed by the outside:
hostname(config)# static (inside,outside) 10.1.1.3 10.1.1.3 netmask 255.255.255.255
-
The following command uses static identity NAT for an outside address (209.165.201.15)
when accessed by the inside:
hostname(config)# static (outside,inside) 209.165.201.15 209.165.201.15 netmask
255.255.255.255
- The following command statically maps an entire subnet:
NAT exemption
Information about NAT Exemption
NAT exemption exempts addresses from translation and allows both translated and remote hosts
to initiate connections. Like identity NAT, you do not limit translation for a host on specific
interfaces; you must use NAT exemption for connections through all interfaces. However,
NAT exemption does enable you to specify the real and destination addresses when determining
the real addresses to translate (similar to policy NAT), so you have greater control using NAT
exemption than identity NAT. However, unlike policy NAT, NAT exemption does not consider
the ports in the access list. Use static identity NAT to consider ports in the access list
-
If you remove a NAT exemption configuration, existing connections that use NAT
exemption are not affected. To remove these connections, enter the clear local-host
command.
By default, the nat command exempts traffic from inside to outside. If you want traffic
from outside to inside to bypass NAT, then add an additional nat command and enter
outside to identify the NAT instance as outside NAT.
The following examples show how to configure NAT exemption.

To exempt an inside network when accessing any destination address, enter the following
command:
hostname(config)# access-list EXEMPT permit ip 10.1.2.0 255.255.255.0 any
hostname(config)# nat (inside) 0 access-list EXEMPT
To use dynamic outside NAT for a DMZ network, and exempt another DMZ network, enter the
following command:
hostname(config)# nat (dmz) 1 10.1.2.0 255.255.255.0 outside dns
hostname(config)# global (inside) 1 10.1.1.45
hostname(config)# access-list EXEMPT permit ip 10.1.3.0 255.255.255.0 any
hostname(config)# nat (dmz) 0 access-list EXEMPT
To exempt an inside address when accessing two different destination addresses, enter the
following commands:
hostname(config)# access-list NET1 permit ip 10.1.2.0 255.255.255.0 209.165.201.0
255.255.255.224
hostname(config)# access-list NET1 permit ip 10.1.2.0 255.255.255.0 209.165.200.224
255.255.255.224
hostname(config)# nat (inside) 0 access-list NET1
Dynamic NAT and PAT

Information about dynamic NAT
Dynamic NAT translates a group of real addresses to a pool of mapped addresses that are
routable on the destination network. The mapped pool may include fewer addresses than the real
group. When a host you want to translate accesses the destination network, the adaptive security
appliance assigns the host an IP address from the mapped pool. The translation is added only
when the real host initiates the connection. The translation is in place only for the duration of the
connection, and a given user does not keep the same IP address after the translation times out.
Information about PAT

PAT translates multiple real addresses to a single mapped IP address. Specifically, the security
appliance translates the real address and source port (real socket) to the mapped address and a
unique port above 1024 (mapped socket). Each connection requires a separate translation
because the source port differs for each connection. For example, 10.1.1.1:1025 requires a
separate translation from 10.1.1.1:1026.
After the connection expires, the port translation also expires after 30 seconds of inactivity. The
timeout is not configurable. Users on the destination network cannot reliably initiate a
connection to a host that uses PAT (even if the connection is allowed by an access list). Not only
can you not predict the real or mapped port number of the host, but the adaptive security
appliance does not create a translation at all unless the translated host is the initiator.
PAT lets you use a single mapped address, thus conserving routable addresses. You can even use
the adaptive security appliance interface IP address as the PAT address. PAT does not work with
some multimedia applications that have a data stream that is different from the control path.
Configuring Dynamic NAT
For dynamic NAT and PAT, you first configure a nat command identifying the real
addresses on a given interface that you want to translate. Then you configure a separate
global command to specify the mapped addresses when exiting another interface (in the
case of PAT, this is one address). Each nat command matches a global command by
comparing the NAT ID, a number that you assign to each command.

hostname(config)# global (outside) 1 209.165.201.3-209.165.201.10
You can enter multiple nat commands using the same NAT ID on one or more interfaces; they all use
the same global command when traffic exits a given interface.

hostname(config)# nat (dmz) 1 10.1.1.0 255.255.255.0
You can also enter a global command for each interface using the same NAT ID. If you
enter a global command for the Outside and DMZ interfaces on ID 1, then the Inside nat
command identifies traffic to be translated when going to both the Outside and the DMZ
interfaces. Similarly, if you also enter a nat command for the DMZ interface on ID 1,
then the global command on the Outside interface is also used for DMZ traffic.

hostname(config)# global (dmz) 1 10.1.1.23
If you use different NAT IDs, you can identify different sets of real addresses to have
different mapped addresses. For example, on the Inside interface, you can have two nat
commands on two different NAT IDs. On the Outside interface, you configure two global
commands for these two IDs. Then, when traffic from Inside network A exits the Outside
interface, the IP addresses are translated to pool A addresses; while traffic from Inside
network B are translated to pool B addresses.

hostname(config)# global (outside) 2 209.165.201.11
You can enter multiple global commands for one interface using the same NAT ID; the
adaptive security appliance uses the dynamic NAT global commands first, in the order
they are in the configuration, and then it uses the PAT global commands in order. You
might want to enter both a dynamic NAT global command and a PAT global command if
you need to use dynamic NAT for a particular application, but you should have a backup
PAT statement in case all the dynamic NAT addresses are depleted. Similarly, you might
enter two PAT statements if you need more than the approximately 64,000 PAT sessions
that a single PAT mapped statement supports.

hostname(config)# global (outside) 1 209.165.201.5
For outside NAT (from outside to inside), you need to use the outside keyword in the nat
command. If you also want to translate the same traffic when it accesses an outside
interface (for example, traffic on a DMZ is translated when accessing the Inside and the
Outside interfaces), then you must configure a separate nat command without the outside
option. In this case, you can identify the same addresses in both statements and use the
same NAT ID.
Note that for outside NAT (DMZ interface to Inside interface), the inside host uses a
static command to allow outside access, so both the source and destination addresses are
translated.
When you specify a group of IP address(es) in a nat command, then you must perform
NAT on that group of addresses when they access any lower or same security level
interface; you must apply a global command with the same NAT ID on each interface, or
use a static command. NAT is not required for that group when it accesses a higher
security interface because to perform NAT from outside to inside you must create a
separate nat command using the outside keyword. If you do apply outside NAT, then the
NAT requirements preceding come into effect for that group of addresses when they
access all higher security interfaces. Traffic identified by a static command is not
affected.
hostname(config)# nat (dmz) 1 10.1.1.0 255.255.255.0 outside

hostname(config)# global (inside) 1 10.1.2.30-1-10.1.2.40
IOS
NAT order of operation
In this table, when NAT performs the global to local, or local to global, translation is different in
each flow.
Inside-to-Outside
Outside-to-Inside
If IPSec then check input access

list
If IPSec then check input

access list
decryption - for CET (Cisco

Encryption Technology) or IPSec
decryption - for CET or IPSec
check input access list
check input rate limits
input accounting
redirect to web cache
NAT outside to inside (global

to local translation)
check input access list

check input rate limits
input accounting
redirect to web cache
policy routing
routing
policy routing
NAT inside to outside (local to

global translation)
routing
crypto (check map and mark for

encryption)
crypto (check map and mark

for encryption)
check output access list
check output access list
inspect (Context-based Access

Control (CBAC))
TCP intercept
encryption
Queueing
inspect CBAC
TCP intercept
encryption
Queueing
NAT Types
Static NATStatic NAT creates a fixed translation of real addresses to mapped

addresses. With dynamic NAT and PAT, each host uses a different address or port for each
subsequent translation.
Dynamic NATDynamic NAT translates a group of real addresses to a pool of mapped

addresses that are routable on the destination network.
Overloading (PAT)PAT translates multiple real address to a single mapped IP address.
Static NAT
Any packet received in the inside interface with a source address of 172.16.10.8:8080 will be
translated to 172.16.10.8:80. This also implies that any packet received on the outside interface
with a destination address of 172.16.10.8:80 will have the destination translated to
172.16.10.8:8080.
NAT Router
interface ethernet 0
ip address 172.16.10.1 255.255.255.0
ip nat inside
!--- Defines Ethernet 0 with an IP address and as a NAT inside
interface.
interface serial 0
ip address 200.200.200.5 255.255.255.252
ip nat outside
!--- Defines serial 0 with an IP address and as a NAT outside interface.
ip nat inside source static tcp 172.16.10.8 8080 172.16.10.8 80
!--- Static NAT command that states any packet received in the inside
!--- interface with a source IP address of 172.16.10.8:8080 will be
!--- translated to 172.16.10.8:80.
Dynamic NAT
Notice that only the first 32 addresses from subnet 10.10.10.0 and the first 32 addresses from
subnet 10.10.20.0 are permitted by access-list 7. Therefore, only these source addresses are
translated. There may be other devices with other addresses on the inside network, but these
won't be translated.
NAT Router
ip address 10.10.10.1 255.255.255.0
ip nat inside
!--- Defines Ethernet 0 with an IP address and as a NAT inside interface.
ip address 10.10.20.1 255.255.255.0
ip nat inside
interface serial 0
ip address 172.16.10.64 255.255.255.0
ip nat outside
ip nat pool no-overload 172.16.10.1 172.16.10.63 prefix 24

!
!--- Defines a NAT pool named no-overload with a range of addresses
!--- 172.16.10.1 - 172.16.10.63.
ip nat inside source list 7 pool no-overload
!
!--- Indicates that any packets received on the inside interface that
!--- are permitted by access-list 7
!--- will have the source address translated to an address out of the
!--- NAT pool "no-overload".
access-list 7 permit 10.10.10.0 0.0.0.31

!--- Access-list 7 permits packets with source addresses ranging from
!--- 10.10.10.0 through 10.10.10.31 and 10.10.20.0 through 10.10.20.31.
Overloading PAT
The NAT pool "ovrld" only has a range of one address. The keyword overload used in the ip nat
inside source list 7 pool ovrld overload command allows NAT to translate multiple inside
devices to the single address in the pool.
Another variation of this command is ip nat inside source list 7 interface serial 0 overload,
which configures NAT to overload on the address that is assigned to the serial 0 interface.
When overloading is configured, the router maintains enough information from higher-level
protocols (for example, TCP or UDP port numbers) to translate the global address back to the
correct local address.
NAT Router
ip address 10.10.10.1 255.255.255.0
ip nat inside
ip address 10.10.20.1 255.255.255.0
ip nat inside
interface serial 0
ip address 172.16.10.64 255.255.255.0
ip nat outside

ip nat pool ovrld 172.16.10.1 172.16.10.1 prefix 24
!
!--- Defines a NAT pool named ovrld with a range of a single IP
!--- address, 172.16.10.1.
ip nat inside source list 7 pool ovrld overload
!
!
!
!
!--- Indicates that any packets received on the inside interface that
!--- are permitted by access-list 7 will have the source address
!--- translated to an address out of the NAT pool named ovrld.
!--- Translations will be overloaded which will allow multiple inside
!--- devices to be translated to the same valid IP address.
!--- Access-list 7 permits packets with source addresses ranging from
!--- 10.10.10.0 through 10.10.10.31 and 10.10.20.0 through 10.10.20.31.
Troubleshooting
Customer has a couple of web servers on their internal network. They need to provide access
from external hosts to these servers on port 443. They have an ASA5510 which has static NAT to
translate the inbound destination IP from an external address to the real internal address of the
servers. This all works fine. I can see inbound packets being translated and squirted out the
inside interface to the servers, via an internal L3 switch.
However, the ASA is NOT the default gateway of the internal L3 switch, so responses from the
servers hit their default gw (the L3 switch), and the L3 switch forwards the response to it's
default gw which is a different firewall (not the ASA the request came in on).
So the problem is the client never sees the response from the server.
Without changing the default gw of the L3 switch, how could we solve this problem?
Answer:
You can use policy static or policy nat.
static (outside,inside) inside_address access-list change-source-ip
access-list change-source-ip permit ip host source_ip_internet host webserver_ip_public
nat (outside) access-list change-source-ip outside ---> you need the keyword outside
global (inside) interface
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
I want to Source Nat Traffic going from one internal Host to one Specific External Host (remote
system) to a specific IP on an outside Interface.
E.g
Traffic from Internal Host 10.1.1.1 Port 25 sent to 8.8.8.8 should get the External IP 3.3.3.3
TCP Port 25 (as destination).
Answer:
ip nat inside source static 10.1.1.1 3.3.3.3 route-map test
route-map test permit 10
match ip address 101
access-list 101 permit tcp host 10.1.1.1 host 8.8.8.8 eq 25
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
What kind of situation I should use the ip nat outside/destination command in the nat
configuration?
Answer:
The ip nat outside command is used to translate incoming address (from e.g. the Internet) to local
addresses. In the example below, 193.128.1.23 is a public IP address that you want to translate to
an address on your local network, 10.100.2.1.
ip nat outside source static 193.128.1.23 10.100.2.1
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Let's say that you're encrypting traffic with IPSec and you're using NAT. In this scenario, you're
using local-to-global NAT (i.e., inside-to-outside), and you create an access list to define the
traffic you want to encrypt.
When you create the crypto access list to define the traffic that will go through NAT, will the
source IP address of the traffic be the inside IP (i.e., local IP) or the outside IP (i.e., global IP)?
Since inside-to-outside translation occurred before the crypto step, you would use the post-NAT
IP address in the crypto map, assuming you want to encrypt the post-NAT traffic. Many times,
you want to use NAT on some traffic to the Internet, and you don't want to used NAT on
encrypted traffic.
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
For our final scenario, let's say you want to permit SSH traffic coming into your router from the
outside network to an inside host using static NAT. Here are the relevant lines from the
configuration:
interface Ethernet0/0
ip address 172.16.6.6 255.255.255.0
ip access-group 150 in
ip nat outside
interface Ethernet0/1
ip address 10.10.10.6 255.255.255.0
ip nat inside
ip nat inside source static 10.10.10.4 172.16.6.14

access-list 150 permit tcp any host x.x.x.x eq 22
access-list 150 deny ip any any log
Look at the access list and notice the x.x.x.x. Which IP address would go in that access list:
10.10.10.4 or 172.16.6.14?
In the NAT Order of Operations, you can see that the router always checks an input access list
before NAT occurs. Therefore, you would use the pre-NAT IP address, which would be
172.16.6.14.

NAT Order of Operations 82

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

NAT Order of Operations 82

Uploaded by

Copyright:

Available Formats

Network Address Translation (NAT)

PATPAT translates multiple real addresses to a single mapped IP address.

NAT order of operation

Match against existing xlates

ciscoasa(config)# packet-tracer input outside tcp 172.168.1.2 1025 10.198.28.3 80

translate_hits = 0, untranslate_hits = 153

NAT from inside:192.168.1.0 to outside:10.198.28.0 flags s

ciscoasa(config)# packet-tracer input outside tcp 172.168.1.2 1025 10.198.28.8 80

NAT from inside:192.168.1.0 to outside(110):192.168.1.0 flags s

NAT Control and Inside Interfaces

Configuring NAT Control

Configuring Policy Static NAT

Configuring Regular Static NAT

The following command maps an inside IP address (10.1.1.3) to an outside IP address

hostname(config)# route dmz 192.168.100.128 255.255.255.128 10.1.1.2 1

Port Redirection (Forwarding) with Statics

static (inside,outside) tcp 172.18.124.99 telnet 10.1.1.6 telnet netmask 255.255.255.255 0 0

Configuring Static PAT

Regular Static PAT

Static Identity NAT

Configuring Policy Static Identity NAT

The following examples show how to configure NAT exemption.

Dynamic NAT and PAT

Information about PAT

Configuring Dynamic NAT

hostname(config)# nat (inside) 1 10.1.2.0 255.255.255.0

hostname(config)# nat (inside) 1 10.1.2.0 255.255.255.0

hostname(config)# nat (inside) 1 10.1.2.0 255.255.255.0

hostname(config)# nat (inside) 1 10.1.2.0 255.255.255.0

hostname(config)# nat (inside) 1 10.1.2.0 255.255.255.0

hostname(config)# nat (dmz) 1 10.1.1.0 255.255.255.0 outside

If IPSec then check input access

If IPSec then check input

decryption - for CET (Cisco

decryption - for CET or IPSec

check input access list

check input rate limits

redirect to web cache

NAT outside to inside (global

check input access list

NAT inside to outside (local to

crypto (check map and mark for

crypto (check map and mark

check output access list

check output access list

inspect (Context-based Access

Static NATStatic NAT creates a fixed translation of real addresses to mapped

Dynamic NATDynamic NAT translates a group of real addresses to a pool of mapped

Overloading (PAT)PAT translates multiple real address to a single mapped IP address.

ip nat pool no-overload 172.16.10.1 172.16.10.63 prefix 24

access-list 7 permit 10.10.10.0 0.0.0.31

!--- Defines serial 0 with an IP address and as a NAT outside interface.

ip nat inside source static 10.10.10.4 172.16.6.14

You might also like