Cisco ASA 5500 Series Configuration Guide using the CLI, 8.4 and 8.6

Step 1

Network object:

object network obj_name

Network object group:

object-group network grp_name

hostname(config)# object network MyInsNet

hostname(config-network-object)# subnet 10.1.1.0 255.255.255.0

Configure the real source addresses.

You can configure either a network object or a network object group. For more information, see the “Configuring Objects” section.

If you want to translate all traffic, you can skip this step and specify the any keyword instead of creating an object or group.

Step 2

Network object:

object network obj_name

Network object group:

object-group network grp_name

hostname(config)# object network NAT_POOL

hostname(config-network-object)# range 209.165.201.10 209.165.201.20

Configure the mapped source addresses.

You can configure either a network object or a network object group.

For dynamic NAT, you typically configure a larger group of addresses to be mapped to a smaller group. If a mapped network object contains both ranges and host IP addresses, then the ranges are used for dynamic NAT, and then the host IP addresses are used as a PAT fallback.

Note The mapped object or group cannot contain a subnet.

See the “Guidelines and Limitations” section for information about disallowed mapped IP addresses.

Step 3

(Optional)

Network object:

object network obj_name

Network object group:

object-group network grp_name

hostname(config)# object network Server1

hostname(config-network-object)# host 209.165.201.8

Configure the real destination addresses.

You can configure either a network object or a network object group.

Although the main feature of twice NAT is the inclusion of the destination IP address, the destination address is optional. If you do specify the destination address, you can configure static translation for that address or just use identity NAT for it. You might want to configure twice NAT without a destination address to take advantage of some of the other qualities of twice NAT, including the use of network object groups for real addresses, or manually ordering of rules. For more information, see the “Main Differences Between Network Object NAT and Twice NAT” section.

Step 4

(Optional)

Network object:

object network obj_name

Network object group:

object-group network grp_name

hostname(config)# object network Server1_mapped

hostname(config-network-object)# host 10.1.1.67

Configure the mapped destination addresses.

The destination translation is always static. For identity NAT, you can skip this step and simply use the same object or group for both the real and mapped addresses.

If you want to translate the destination address, you can configure either a network object or a network object group. The static mapping is typically one-to-one, so the real addresses have the same quantity as the mapped addresses. You can, however, have different quantities if desired. For more information, see the “Static NAT” section.

For static interface NAT with port translation (routed mode only), you can skip this step and specify the interface keyword instead of a network object/group for the mapped address. For more information, see the “Static Interface NAT with Port Translation” section.

Step 5

(Optional)

object service obj_name

hostname(config)# object service REAL_SVC

hostname(config-service-object)# service tcp destination eq 80

hostname(config)# object service MAPPED_SVC

hostname(config-service-object)# service tcp destination eq 8080

Configure service objects for:

• Destination real port
• Destination mapped port

Dynamic NAT does not support port translation. However, because the destination translation is always static, you can perform port translation for the destination port. A service object can contain both a source and destination port, but only the destination port is used in this case. If you specify the source port, it will be ignored. NAT only supports TCP or UDP. When translating a port, be sure the protocols in the real and mapped service objects are identical (both TCP or both UDP). For identity NAT, you can use the same service object for both the real and mapped ports. The “not equal” (neq) operator is not supported.

Step 6

nat [ ( real_ifc , mapped_ifc ) ] [ line | { after-auto [ line ]}] source dynamic { real_obj | any } { mapped_obj [ interface ]} [ destination static { mapped_obj | interface } real_obj ] [ service mapped_dest_svc_obj real_dest_svc_obj ] [ dns ] [ inactive ] [ description desc ]

hostname(config)# nat (inside,outside) source dynamic MyInsNet NAT_POOL destination static Server1_mapped Server1 service MAPPED_SVC REAL_SVC

Configure dynamic NAT. See the following guidelines:

• Interfaces—(Required for transparent mode) Specify the real and mapped interfaces. Be sure to include the parentheses in your command. In routed mode, if you do not specify the real and mapped interfaces, all interfaces are used; you can also specify the keyword any for one or both of the interfaces.
• Section and Line—(Optional) By default, the NAT rule is added to the end of section 1 of the NAT table (see the “NAT Rule Order” section). If you want to add the rule into section 3 instead (after the network object NAT rules), then use the after-auto keyword. You can insert a rule anywhere in the applicable section using the line argument.
• Source addresses:

– Real—Specify a network object, group, or the any keyword (see Step 1). Use the any keyword if you want to translate all traffic from the real interface to the mapped interface.

– Mapped—Specify a different network object or group (see Step 2). You can optionally configure the following fallback method:

Interface PAT fallback—(Routed mode only) The interface keyword enables interface PAT fallback. After the mapped IP addresses are used up, then the IP address of the mapped interface is used. For this option, you must configure a specific interface for the mapped_ifc.

(Continued)

• Destination addresses (Optional):

– Mapped—Specify a network object or group, or for static interface NAT with port translation only, specify the interface keyword (see Step 4). If you specify interface, be sure to also configure the service keyword. For this option, you must configure a specific interface for the real_ifc. See the “Static Interface NAT with Port Translation” section for more information.

– Real—Specify a network object or group (see Step 3). For identity NAT, simply use the same object or group for both the real and mapped addresses.

• Destination port—(Optional) Specify the service keyword along with the mapped and real service objects (see Step 5). For identity port translation, simply use the same service object for both the real and mapped ports.
• DNS—(Optional; for a source-only rule) The dns keyword translates DNS replies. Be sure DNS inspection is enabled (it is enabled by default). You cannot configure the dns keyword if you configure a destination address. See the “DNS and NAT” section for more information.
• Inactive—(Optional) To make this rule inactive without having to remove the command, use the inactive keyword. To reactivate it, reenter the whole command without the inactive keyword.
• Description—Optional) Provide a description up to 200 characters using the description keyword.

Step 1

Network object:

object network obj_name

Network object group:

object-group network grp_name

hostname(config)# object network MyInsNet

hostname(config-network-object)# subnet 10.1.1.0 255.255.255.0

Configure the real source addresses.

You can configure either a network object or a network object group. For more information, see the “Configuring Objects” section.

If you want to translate all traffic, you can skip this step and specify the any keyword instead of creating an object or group.

Step 2

Network object:

object network obj_name

Network object group:

object-group network grp_name

hostname(config)# object network PAT_POOL1

hostname(config-network-object)# range 10.5.1.80 10.7.1.80

hostname(config)# object network PAT_POOL2

hostname(config-network-object)# range 10.9.1.1 10.10.1.1

hostname(config)# object network PAT_IP

hostname(config-network-object)# host 10.5.1.79

hostname(config-network-object)# object-group network PAT_POOLS

hostname(config-network)# network-object object PAT_POOL1

hostname(config-network)# network-object object PAT_POOL2

hostname(config-network)# network-object object PAT_IP

Specify the mapped address(es) (that you want to translate to). You can configure a single address or, for a PAT pool, multiple addresses. Configure a network object or network object group. A network object group can contain objects and/or inline addresses. Alternatively, you can skip this step if you want to enter a single IP address as an inline value for the nat command or if you want to use the interface address by specifying the interface keyword.

For mapped addresses used as a PAT pool, all addresses in the object or group, including ranges, are used as PAT addresses.

Note The object or group cannot contain a subnet.

See the “Guidelines and Limitations” section for information about disallowed mapped IP addresses.

For more information about configuring a network object or group, see the “Configuring Objects” section.

Step 3

(Optional)

Network object:

object network obj_name

Network object group:

object-group network grp_name

hostname(config)# object network Server1

hostname(config-network-object)# host 209.165.201.8

Configure the real destination addresses.

You can configure either a network object or a network object group.

Although the main feature of twice NAT is the inclusion of the destination IP address, the destination address is optional. If you do specify the destination address, you can configure static translation for that address or just use identity NAT for it. You might want to configure twice NAT without a destination address to take advantage of some of the other qualities of twice NAT, including the use of network object groups for real addresses, or manually ordering of rules. For more information, see the “Main Differences Between Network Object NAT and Twice NAT” section.

Step 4

(Optional)

Network object:

object network obj_name

Network object group:

object-group network grp_name

hostname(config)# object network Server1_mapped

hostname(config-network-object)# host 10.1.1.67

Configure the mapped destination addresses.

The destination translation is always static. For identity NAT, you can skip this step and simply use the same object or group for both the real and mapped addresses.

If you want to translate the destination address, you can configure either a network object or a network object group. The static mapping is typically one-to-one, so the real addresses have the same quantity as the mapped addresses. You can, however, have different quantities if desired. For more information, see the “Static NAT” section.

For static interface NAT with port translation (routed mode only), you can skip this step and specify the interface keyword instead of a network object/group for the mapped address. For more information, see the “Static Interface NAT with Port Translation” section.

Step 5

(Optional)

object service obj_name

hostname(config)# object service REAL_SVC

hostname(config-service-object)# service tcp destination eq 80

hostname(config)# object service MAPPED_SVC

hostname(config-service-object)# service tcp destination eq 8080

Configure service objects for:

• Destination real port
• Destination mapped port

Dynamic PAT does not support additional port translation. However, because the destination translation is always static, you can perform port translation for the destination port. A service object can contain both a source and destination port, but only the destination port is used in this case. If you specify the source port, it will be ignored. NAT only supports TCP or UDP. When translating a port, be sure the protocols in the real and mapped service objects are identical (both TCP or both UDP). For identity NAT, you can use the same service object for both the real and mapped ports. The “not equal” (neq) operator is not supported.

Step 6

nat [ ( real_ifc , mapped_ifc ) ] [ line | { after-auto [ line ]}] source dynamic { real-obj | any } { mapped_obj [ interface ] | [ pat-pool mapped_obj [ round-robin ] [ extended ] [ flat [ include-reserve ]] [ interface ] | interface } [ destination static { mapped_obj | interface } real_obj ] [ service mapped_dest_svc_obj real_dest_svc_obj ] [ dns ] [ inactive ] [ description desc ]

hostname(config)# nat (inside,outside) source dynamic MyInsNet interface destination static Server1 Server1 description Interface PAT for inside addresses when going to server 1

Configures dynamic PAT (hide). See the following guidelines:

• Interfaces—(Required for transparent mode) Specify the real and mapped interfaces. Be sure to include the parentheses in your command. In routed mode, if you do not specify the real and mapped interfaces, all interfaces are used; you can also specify the keyword any for one or both of the interfaces.
• Section and Line—(Optional) By default, the NAT rule is added to the end of section 1 of the NAT table (see the “NAT Rule Order” section). If you want to add the rule into section 3 instead (after the network object NAT rules), then use the after-auto keyword. You can insert a rule anywhere in the applicable section using the line argument.
• Source addresses:

– Real—Specify a network object, group, or the any keyword (see Step 1). Use the any keyword if you want to translate all traffic from the real interface to the mapped interface.

– Mapped—Configure one of the following:

- Network object—Specify a network object that contains a host address (see Step 2).

- pat-pool —Specify the pat-pool keyword and a network object or group that contains multiple addresses (see Step 2).

- interface —(Routed mode only) Specify the interface keyword alone to only use interface PAT. When specified with a PAT pool or network object, the interface keyword enables interface PAT fallback. After the PAT IP addresses are used up, then the IP address of the mapped interface is used. For this option, you must configure a specific interface for the mapped_ifc.

(continued)

(continued)

For a PAT pool, you can specify one or more of the following options:

-- Round robin—The round-robin keyword enables round-robin address allocation for a PAT pool. Without round robin, by default all ports for a PAT address will be allocated before the next PAT address is used. The round-robin method assigns an address/port from each PAT address in the pool before returning to use the first address again, and then the second address, and so on.

-- Extended PAT—(8.4(3) and later, not including 8.5(1) or 8.6(1)) The extended keyword enables extended PAT. Extended PAT uses 65535 ports per service, as opposed to per IP address, by including the destination address and port in the translation information. Normally, the destination port and address are not considered when creating PAT translations, so you are limited to 65535 ports per PAT address. For example, with extended PAT, you can create a translation of 10.1.1.1:1027 when going to 192.168.1.7:23 as well as a translation of 10.1.1.1:1027 when going to 192.168.1.7:80.

-- Flat range—(8.4(3) and later, not including 8.5(1) or 8.6(1)) The flat keyword enables use of the entire 1024 to 65535 port range when allocating ports. When choosing the mapped port number for a translation, the ASA uses the real source port number if it is available. However, without this option, if the real port is not available, by default the mapped ports are chosen from the same range of ports as the real port number: 1 to 511, 512 to 1023, and 1024 to 65535. To avoid running out of ports at the low ranges, configure this setting. To use the entire range of 1 to 65535, also specify the include-reserve keyword.

(continued)

(continued)

• Destination addresses (Optional):

– Mapped—Specify a network object or group, or for static interface NAT with port translation only (routed mode), specify the interface keyword (see Step 4). If you specify interface, be sure to also configure the service keyword. For this option, you must configure a specific interface for the real_ifc. See the “Static Interface NAT with Port Translation” section for more information.

– Real—Specify a network object or group (see Step 3). For identity NAT, simply use the same object or group for both the real and mapped addresses.

• Destination port—(Optional) Specify the service keyword along with the real and mapped service objects (see Step 5). For identity port translation, simply use the same service object for both the real and mapped ports.
• DNS—(Optional; for a source-only rule) The dns keyword translates DNS replies. Be sure DNS inspection is enabled (it is enabled by default). You cannot configure the dns keyword if you configure a destination address. See the “DNS and NAT” section for more information.
• Inactive—(Optional) To make this rule inactive without having to remove the command, use the inactive keyword. To reactivate it, reenter the whole command without the inactive keyword.
• Description—(Optional) Provide a description up to 200 characters using the description keyword.

Step 1

Network object:

object network obj_name

Network object group:

object-group network grp_name

hostname(config)# object network MyInsNet

hostname(config-network-object)# subnet 10.1.1.0 255.255.255.0

Configure the real source addresses.

You can configure either a network object or a network object group. For more information, see the “Configuring Objects” section.

Step 2

Network object:

object network obj_name

Network object group:

object-group network grp_name

hostname(config)# object network MyInsNet_mapped

hostname(config-network-object)# subnet 192.168.1.0 255.255.255.0

Configure the mapped source addresses.

You can configure either a network object or a network object group. For static NAT, the mapping is typically one-to-one, so the real addresses have the same quantity as the mapped addresses. You can, however, have different quantities if desired. For more information, see the “Static NAT” section.

For static interface NAT with port translation (routed mode only), you can skip this step and specify the interface keyword instead of a network object/group for the mapped address. For more information, see the “Static Interface NAT with Port Translation” section.

See the “Guidelines and Limitations” section for information about disallowed mapped IP addresses.

Step 3

(Optional)

Network object:

object network obj_name

Network object group:

object-group network grp_name

hostname(config)# object network Server1

hostname(config-network-object)# host 209.165.201.8

Configure the real destination addresses.

You can configure either a network object or a network object group.

Although the main feature of twice NAT is the inclusion of the destination IP address, the destination address is optional. If you do specify the destination address, you can configure static translation for that address or just use identity NAT for it. You might want to configure twice NAT without a destination address to take advantage of some of the other qualities of twice NAT, including the use of network object groups for real addresses, or manually ordering of rules. For more information, see the “Main Differences Between Network Object NAT and Twice NAT” section.

Step 4

(Optional)

Network object:

object network obj_name

Network object group:

object-group network grp_name

hostname(config)# object network Server1_mapped

hostname(config-network-object)# host 10.1.1.67

Configure the mapped destination addresses.

The destination translation is always static. For identity NAT, you can skip this step and simply use the same object or group for both the real and mapped addresses.

If you want to translate the destination address, you can configure either a network object or a network object group. The static mapping is typically one-to-one, so the real addresses have the same quantity as the mapped addresses. You can, however, have different quantities if desired. For more information, see the “Static NAT” section.

For static interface NAT with port translation (routed mode only), you can skip this step and specify the interface keyword instead of a network object/group for the mapped address. For more information, see the “Static Interface NAT with Port Translation” section.

Step 5

(Optional)

object service obj_name

hostname(config)# object service REAL_SRC_SVC

hostname(config-service-object)# service tcp source eq 80

hostname(config)# object service MAPPED_SRC_SVC

hostname(config-service-object)# service tcp source eq 8080

Configure service objects for:

• Source or destination real port
• Source or destination mapped port

A service object can contain both a source and destination port; however, you should specify either the source or the destination port for both service objects. You should only specify both the source and destination ports if your application uses a fixed source port (such as some DNS servers); but fixed source ports are rare. NAT only supports TCP or UDP. When translating a port, be sure the protocols in the real and mapped service objects are identical (both TCP or both UDP). For identity NAT, you can use the same service object for both the real and mapped ports. The “not equal” (neq) operator is not supported.

For example, if you want to translate the port for the source host, then configure the source service.

Step 6

nat [ ( real_ifc , mapped_ifc ) ] [ line | { after-object [ line ]}] source static real_ob [ mapped_obj | interface ] [ destination static { mapped_obj | interface } real_obj ] [ service real_src_mapped_dest_svc_obj mapped_src_real_dest_svc_obj ] [ dns ] [ no-proxy-arp ] [ inactive ] [ description desc ]

hostname(config)# nat (inside,dmz) source static MyInsNet MyInsNet_mapped destination static Server1 Server1 service REAL_SRC_SVC MAPPED_SRC_SVC

Configures static NAT. See the following guidelines:

• Interfaces—(Required for transparent mode) Specify the real and mapped interfaces. Be sure to include the parentheses in your command. In routed mode, if you do not specify the real and mapped interfaces, all interfaces are used; you can also specify the keyword any for one or both of the interfaces.
• Section and Line—(Optional) By default, the NAT rule is added to the end of section 1 of the NAT table. See the “NAT Rule Order” section for more information about sections. If you want to add the rule into section 3 instead (after the network object NAT rules), then use the after-auto keyword. You can insert a rule anywhere in the applicable section using the line argument.
• Source addresses:

– Real—Specify a network object or group (see Step 1).

– Mapped—Specify a different network object or group (see Step 2). For static interface NAT with port translation only, you can specify the interface keyword (routed mode only). If you specify interface, be sure to also configure the service keyword (in this case, the service objects should include only the source port). For this option, you must configure a specific interface for the mapped_ifc. See the “Static Interface NAT with Port Translation” section for more information.

• Destination addresses (Optional):

– Mapped—Specify a network object or group, or for static interface NAT with port translation only, specify the interface keyword (see Step 4). If you specify interface, be sure to also configure the service keyword (in this case, the service objects should include only the destination port). For this option, you must configure a specific interface for the real_ifc.

– Real—Specify a network object or group (see Step 3). For identity NAT, simply use the same object or group for both the real and mapped addresses.

(Continued)

• Ports—(Optional) Specify the service keyword along with the real and mapped service objects (see Step 5). For source port translation, the objects must specify the source service. The order of the service objects in the command for source port translation is service real_obj mapped_obj. For destination port translation, the objects must specify the destination service. The order of the service objects for destination port translation is service mapped_obj real_obj. In the rare case where you specify both the source and destination ports in the object, the first service object contains the real source port/mapped destination port; the second service object contains the mapped source port/real destination port. For identity port translation, simply use the same service object for both the real and mapped ports (source and/or destination ports, depending on your configuration).
• DNS—(Optional; for a source-only rule) The dns keyword translates DNS replies. Be sure DNS inspection is enabled (it is enabled by default). You cannot configure the dns keyword if you configure a destination address. See the “DNS and NAT” section for more information.
• No Proxy ARP—(Optional) Specify no-proxy-arp to disable proxy ARP for incoming packets to the mapped IP addresses. See the “Mapped Addresses and Routing” section for more information.
• Inactive—(Optional) To make this rule inactive without having to remove the command, use the inactive keyword. To reactivate it, reenter the whole command without the inactive keyword.
• Description—(Optional) Provide a description up to 200 characters using the description keyword.

Step 1

Network object:

object network obj_name

Network object group:

object-group network grp_name

hostname(config)# object network MyInsNet

hostname(config-network-object)# subnet 10.1.1.0 255.255.255.0

Configure the real source addresses.

You can configure either a network object or a network object group. For more information, see the “Configuring Objects” section.

These are the addresses on which you want to perform identity NAT. If you want to perform identity NAT for all addresses, you can skip this step and instead use the keywords any any.

Step 2

(Optional)

Network object:

object network obj_name

Network object group:

object-group network grp_name

hostname(config)# object network Server1

hostname(config-network-object)# host 209.165.201.8

Configure the real destination addresses.

You can configure either a network object or a network object group.

Although the main feature of twice NAT is the inclusion of the destination IP address, the destination address is optional. If you do specify the destination address, you can configure static translation for that address or just use identity NAT for it. You might want to configure twice NAT without a destination address to take advantage of some of the other qualities of twice NAT, including the use of network object groups for real addresses, or manually ordering of rules. For more information, see the “Main Differences Between Network Object NAT and Twice NAT” section.

Step 3

(Optional)

Network object:

object network obj_name

Network object group:

object-group network grp_name

hostname(config)# object network Server1_mapped

hostname(config-network-object)# host 10.1.1.67

Configure the mapped destination addresses.

The destination translation is always static. For identity NAT, you can skip this step and simply use the same object or group for both the real and mapped addresses.

If you want to translate the destination address, you can configure either a network object or a network object group. The static mapping is typically one-to-one, so the real addresses have the same quantity as the mapped addresses. You can, however, have different quantities if desired. For more information, see the “Static NAT” section.

For static interface NAT with port translation (routed mode only), you can skip this step and specify the interface keyword instead of a network object/group for the mapped address. For more information, see the “Static Interface NAT with Port Translation” section.

Step 4

(Optional)

object service obj_name

hostname(config)# object service REAL_SRC_SVC

hostname(config-service-object)# service tcp source eq 80

hostname(config)# object service MAPPED_SRC_SVC

hostname(config-service-object)# service tcp source eq 8080

Configure service objects for:

• Source or destination real port
• Source or destination mapped port

A service object can contain both a source and destination port; however, you should specify either the source or the destination port for both service objects. You should only specify both the source and destination ports if your application uses a fixed source port (such as some DNS servers); but fixed source ports are rare. NAT only supports TCP or UDP. When translating a port, be sure the protocols in the real and mapped service objects are identical (both TCP or both UDP). For identity NAT, you can use the same service object for both the real and mapped ports. The “not equal” (neq) operator is not supported.

For example, if you want to translate the port for the source host, then configure the source service.

Step 5

nat [ ( real_ifc , mapped_ifc ) ] [ line | { after-object [ line ]}] source static { nw_obj nw_obj | any any } [ destination static { mapped_obj | interface } real_obj ] [ service real_src_mapped_dest_svc_obj mapped_src_real_dest_svc_obj ] [ no-proxy-arp ] [ route-lookup ] [ inactive ] [ description desc ]

hostname(config)# nat (inside,outside) source static MyInsNet MyInsNet destination static Server1 Server1

Configures identity NAT. See the following guidelines:

• Interfaces—(Required for transparent mode) Specify the real and mapped interfaces. Be sure to include the parentheses in your command. In routed mode, if you do not specify the real and mapped interfaces, all interfaces are used; you can also specify the keyword any for one or both of the interfaces.
• Section and Line—(Optional) By default, the NAT rule is added to the end of section 1 of the NAT table. See the “NAT Rule Order” section for more information about sections. If you want to add the rule into section 3 instead (after the network object NAT rules), then use the after-auto keyword. You can insert a rule anywhere in the applicable section using the line argument.
• Source addresses—Specify a network object, group, or the any keyword for both the real and mapped addresses (see Step 1).
• Destination addresses (Optional):

– Mapped—Specify a network object or group, or for static interface NAT with port translation only, specify the interface keyword (routed mode only) (see Step 3). If you specify interface, be sure to also configure the service keyword (in this case, the service objects should include only the destination port). For this option, you must configure a specific interface for the real_ifc. See the “Static Interface NAT with Port Translation” section for more information.

– Real—Specify a network object or group (see Step 2). For identity NAT, simply use the same object or group for both the real and mapped addresses.

• Port—(Optional) Specify the service keyword along with the real and mapped service objects (see Step 4). For source port translation, the objects must specify the source service. The order of the service objects in the command for source port translation is service real_obj mapped_obj. For destination port translation, the objects must specify the destination service. The order of the service objects for destination port translation is service mapped_obj real_obj. In the rare case where you specify both the source and destination ports in the object, the first service object contains the real source port/mapped destination port; the second service object contains the mapped source port/real destination port. For identity port translation, simply use the same service object for both the real and mapped ports (source and/or destination ports, depending on your configuration).

(Continued)

• No Proxy ARP—(Optional) Specify no-proxy-arp to disable proxy ARP for incoming packets to the mapped IP addresses. See the “Mapped Addresses and Routing” section for more information.
• Route lookup—(Optional; routed mode only; interface(s) specified) Specify route-lookup to determine the egress interface using a route lookup instead of using the interface specified in the NAT command. See the “Determining the Egress Interface” section for more information.
• Inactive—(Optional) To make this rule inactive without having to remove the command, use the inactive keyword. To reactivate it, reenter the whole command without the inactive keyword.
• Description—(Optional) Provide a description up to 200 characters using the description keyword.