CLI Book 2: Cisco ASA Series Firewall CLI Configuration Guide, 9.1

Adding Network Objects for Mapped Addresses

For dynamic NAT, you must use an object or group for the mapped addresses. Other NAT types have the option of using inline addresses, or you can create an object or group according to this section. For more information about configuring a network object or group, see the general operations configuration guide.

Guidelines

• A network object group can contain objects and/or inline addresses of either IPv4 or IPv6 addresses. The group cannot contain both IPv4 and IPv6 addresses; it must contain one type only.
• See the “Guidelines and Limitations” section for information about disallowed mapped IP addresses.
• Dynamic NAT:

– You cannot use an inline address; you must configure a network object or group.

– The object or group cannot contain a subnet; the object must define a range; the group can include hosts and ranges.

– If a mapped network object contains both ranges and host IP addresses, then the ranges are used for dynamic NAT, and then the host IP addresses are used as a PAT fallback.

• Dynamic PAT (Hide):

– Instead of using an object, you can optionally configure an inline host address or specify the interface address.

– If you use an object, the object or group cannot contain a subnet; the object must define a host, or for a PAT pool, a range; the group (for a PAT pool) can include hosts and ranges.

• Static NAT or Static NAT with port translation:

– Instead of using an object, you can configure an inline address or specify the interface address (for static NAT-with-port-translation).

– If you use an object, the object or group can contain a host, range, or subnet.

• Identity NAT

– Instead of using an object, you can configure an inline address.

– If you use an object, the object must match the real addresses you want to translate.

Detailed Steps

Configuring Dynamic NAT

This section describes how to configure network object NAT for dynamic NAT. For more information, see the “Dynamic NAT” section.

Detailed Steps

Examples

The following example configures dynamic NAT that hides 192.168.2.0 network behind a range of outside addresses 10.2.2.1 through 10.2.2.10:

The following example configures dynamic NAT with dynamic PAT backup. Hosts on inside network 10.76.11.0 are mapped first to the nat-range1 pool (10.10.10.10-10.10.10.20). After all addresses in the nat-range1 pool are allocated, dynamic PAT is performed using the pat-ip1 address (10.10.10.21). In the unlikely event that the PAT translations are also used up, dynamic PAT is performed using the outside interface address.

The following example configures dynamic NAT with dynamic PAT backup to translate IPv6 hosts to IPv4. Hosts on inside network 2001:DB8::/96 are mapped first to the IPv4_NAT_RANGE pool (209.165.201.1 to 209.165.201.30). After all addresses in the IPv4_NAT_RANGE pool are allocated, dynamic PAT is performed using the IPv4_PAT address (209.165.201.31). In the event that the PAT translations are also used up, dynamic PAT is performed using the outside interface address.

Configuring Dynamic PAT (Hide)

This section describes how to configure network object NAT for dynamic PAT (hide). For more information, see the “Dynamic PAT” section.

Guidelines

For a PAT pool:

• If available, the real source port number is used for the mapped port. However, if the real port is not available, by default the mapped ports are chosen from the same range of ports as the real port number: 0 to 511, 512 to 1023, and 1024 to 65535. Therefore, ports below 1024 have only a small PAT pool that can be used. (8.4(3) and later, not including 8.5(1) or 8.6(1)) If you have a lot of traffic that uses the lower port ranges, you can now specify a flat range of ports to be used instead of the three unequal-sized tiers: either 1024 to 65535, or 1 to 65535.
• If you use the same PAT pool object in two separate rules, then be sure to specify the same options for each rule. For example, if one rule specifies extended PAT and a flat range, then the other rule must also specify extended PAT and a flat range.

For extended PAT for a PAT pool:

• Many application inspections do not support extended PAT. See the “Default Settings and NAT Limitations” section in “Getting Started with Application Layer Protocol Inspection,” for a complete list of unsupported inspections.
• If you enable extended PAT for a dynamic PAT rule, then you cannot also use an address in the PAT pool as the PAT address in a separate static NAT-with-port-translation rule. For example, if the PAT pool includes 10.1.1.1, then you cannot create a static NAT-with-port-translation rule using 10.1.1.1 as the PAT address.
• If you use a PAT pool and specify an interface for fallback, you cannot specify extended PAT.
• For VoIP deployments that use ICE or TURN, do not use extended PAT. ICE and TURN rely on the PAT binding to be the same for all destinations.

For round robin for a PAT pool:

• If a host has an existing connection, then subsequent connections from that host will use the same PAT IP address if ports are available. Note : This “stickiness” does not survive a failover. If the ASA fails over, then subsequent connections from a host may not use the initial IP address.
• Round robin, especially when combined with extended PAT, can consume a large amount of memory. Because NAT pools are created for every mapped protocol/IP address/port range, round robin results in a large number of concurrent NAT pools, which use memory. Extended PAT results in an even larger number of concurrent NAT pools.

Detailed Steps

Examples

The following example configures dynamic PAT that hides the 192.168.2.0 network behind address 10.2.2.2:

The following example configures dynamic PAT that hides the 192.168.2.0 network behind the outside interface address:

The following example configures dynamic PAT with a PAT pool to translate the inside IPv6 network to an outside IPv4 network:

ciscoasa(config)# object network IPv4_POOL

ciscoasa(config-network-object)# range 203.0.113.1 203.0.113.254

ciscoasa(config)# object network IPv6_INSIDE

Configuring Static NAT or Static NAT-with-Port-Translation

This section describes how to configure a static NAT rule using network object NAT. For more information, see the “Static NAT” section.

Detailed Steps

Examples

The following example configures static NAT for the real host 10.1.1.1 on the inside to 10.2.2.2 on the outside with DNS rewrite enabled.

The following example configures static NAT for the real host 10.1.1.1 on the inside to 10.2.2.2 on the outside using a mapped object.

The following example configures static NAT-with-port-translation for 10.1.1.1 at TCP port 21 to the outside interface at port 2121.

The following example maps an inside IPv4 network to an outside IPv6 network.

The following example maps an inside IPv6 network to an outside IPv6 network.

Configuring Identity NAT

This section describes how to configure an identity NAT rule using network object NAT. For more information, see the “Identity NAT” section.

Detailed Steps

Example

The following example maps a host address to itself using an inline mapped address:

ciscoasa(config)# object network my-host-obj1

ciscoasa(config-network-object)# host 10.1.1.1

ciscoasa(config-network-object)# nat (inside,outside) static 10.1.1.1

The following example maps a host address to itself using a network object:

ciscoasa(config)# object network my-host-obj1-identity

ciscoasa(config-network-object)# host 10.1.1.1

ciscoasa(config-network-object)# object network my-host-obj1

ciscoasa(config-network-object)# host 10.1.1.1

ciscoasa(config-network-object)# nat (inside,outside) static my-host-obj1-identity

Configuring Per-Session PAT Rules

By default, all TCP PAT traffic and all UDP DNS traffic uses per-session PAT. To use multi-session PAT for traffic, you can configure per-session PAT rules: a permit rule uses per-session PAT, and a deny rule uses multi-session PAT. For more information about per-session vs. multi-session PAT, see the “Per-Session PAT vs. Multi-Session PAT” section.

Defaults

By default, the following rules are installed:

Note You cannot remove these rules, and they always exist after any manually-created rules. Because rules are evaluated in order, you can override the default rules. For example, to completely negate these rules, you could add the following:

Detailed Steps

Examples

The following example creates a deny rule for H.323 traffic, so that it uses multi-session PAT:

Providing Access to an Inside Web Server (Static NAT)

The following example performs static NAT for an inside web server. The real address is on a private network, so a public address is required. Static NAT is necessary so hosts can initiate traffic to the web server at a fixed address. (See Figure 4-1).

Figure 4-1 Static NAT for an Inside Web Server

Step 1 Create a network object for the internal web server:

Step 2 Define the web server address:

Step 3 Configure static NAT for the object:

NAT for Inside Hosts (Dynamic NAT) and NAT for an Outside Web Server (Static NAT)

The following example configures dynamic NAT for inside users on a private network when they access the outside. Also, when inside users connect to an outside web server, that web server address is translated to an address that appears to be on the inside network. (See Figure 4-2).

Figure 4-2 Dynamic NAT for Inside, Static NAT for Outside Web Server

Step 1 Create a network object for the dynamic NAT pool to which you want to translate the inside addresses:

Step 2 Create a network object for the inside network:

Step 3 Enable dynamic NAT for the inside network:

Step 4 Create a network object for the outside web server:

Step 5 Define the web server address:

Step 6 Configure static NAT for the web server:

Inside Load Balancer with Multiple Mapped Addresses (Static NAT, One-to-Many)

The following example shows an inside load balancer that is translated to multiple IP addresses. When an outside host accesses one of the mapped IP addresses, it is untranslated to the single load balancer address. Depending on the URL requested, it redirects traffic to the correct web server. (See Figure 4-3).

Figure 4-3 Static NAT with One-to-Many for an Inside Load Balancer

Step 1 Create a network object for the addresses to which you want to map the load balancer:

Step 2 Create a network object for the load balancer:

Step 3 Define the load balancer address:

Step 4 Configure static NAT for the load balancer:

Single Address for FTP, HTTP, and SMTP (Static NAT-with-Port-Translation)

The following static NAT-with-port-translation example provides a single address for remote users to access FTP, HTTP, and SMTP. These servers are actually different devices on the real network, but for each server, you can specify static NAT-with-port-translation rules that use the same mapped IP address, but different ports. (See Figure 4-4.)

Figure 4-4 Static NAT-with-Port-Translation

Step 1 Create a network object for the FTP server address:

Step 2 Define the FTP server address, and configure static NAT with identity port translation for the FTP server:

Step 3 Create a network object for the HTTP server address:

Step 4 Define the HTTP server address, and configure static NAT with identity port translation for the HTTP server:

Step 5 Create a network object for the SMTP server address:

Step 6 Define the SMTP server address, and configure static NAT with identity port translation for the SMTP server:

DNS Server on Mapped Interface, Web Server on Real Interface (Static NAT with DNS Modification)

For example, a DNS server is accessible from the outside interface. A server, ftp.cisco.com, is on the inside interface. You configure the ASA to statically translate the ftp.cisco.com real address (10.1.3.14) to a mapped address (209.165.201.10) that is visible on the outside network. (See Figure 4-5.) In this case, you want to enable DNS reply modification on this static rule so that inside users who have access to ftp.cisco.com using the real address receive the real address from the DNS server, and not the mapped address.

When an inside host sends a DNS request for the address of ftp.cisco.com, the DNS server replies with the mapped address (209.165.201.10). The ASA refers to the static rule for the inside server and translates the address inside the DNS reply to 10.1.3.14. If you do not enable DNS reply modification, then the inside host attempts to send traffic to 209.165.201.10 instead of accessing ftp.cisco.com directly.

Figure 4-5 DNS Reply Modification

Step 1 Create a network object for the FTP server address:

Step 2 Define the FTP server address, and configure static NAT with DNS modification:

DNS Server and FTP Server on Mapped Interface, FTP Server is Translated (Static NAT with DNS Modification)

Figure 4-6 shows an FTP server and DNS server on the outside. The ASA has a static translation for the outside server. In this case, when an inside user requests the address for ftp.cisco.com from the DNS server, the DNS server responds with the real address, 209.165.201.10. Because you want inside users to use the mapped address for ftp.cisco.com (10.1.2.56) you need to configure DNS reply modification for the static translation.

Figure 4-6 DNS Reply Modification Using Outside NAT

Step 1 Create a network object for the FTP server address:

Step 2 Define the FTP server address, and configure static NAT with DNS modification:

IPv4 DNS Server and FTP Server on Mapped Interface, IPv6 Host on Real Interface (Static NAT64 with DNS64 Modification)

Figure 4-6 shows an FTP server and DNS server on the outside IPv4 network. The ASA has a static translation for the outside server. In this case, when an inside IPv6 user requests the address for ftp.cisco.com from the DNS server, the DNS server responds with the real address, 209.165.200.225. Because you want inside users to use the mapped address for ftp.cisco.com (2001:DB8::D1A5:C8E1) you need to configure DNS reply modification for the static translation. This example also includes a static NAT translation for the DNS server, and a PAT rule for the inside IPv6 hosts.

Figure 4-7 DNS Reply Modification Using Outside NAT

Step 1 Configure static NAT with DNS modification for the FTP server.

a. Create a network object for the FTP server address.

b. Define the FTP server address, and configure static NAT with DNS modification and, because this is a one-to-one translation, configure the net-to-net method for NAT46.

Step 2 Configure NAT for the DNS server.

a. Create a network object for the DNS server address.

b. Define the DNS server address, and configure static NAT using the net-to-net method.

Step 3 Configure an IPv4 PAT pool for translating the inside IPv6 network.

ciscoasa(config)# object network IPv4_POOL

ciscoasa(config-network-object)# range 203.0.113.1 203.0.113.254

Step 4 Configure PAT for the inside IPv6 network.

a. Create a network object for the inside IPv6 network.

b. Define the IPv6 network address, and configure dynamic NAT using a PAT pool.