server-group

Name of the posture validation server group, as configured on the ASA using the aaa-server host command. The name must match the server-tag variable specified in that command.

nac-policy-name

Name of the NAC policy. Enter a string of up to 64 characters to name the NAC policy. The show running-config nac-policy command displays the name and configuration of each NAC policy already present on the security appliance.

nac-framework

Specifies the use of a NAC framework to provide a network access policy for remote hosts. A Cisco Access Control Server must be present on the network to provide NAC Framework services for the ASA.

If you specify this type, the prompt indicates you are in config--nac-policy-nac-framework configuration mode. This mode lets you configure the NAC Framework policy.

nac-policy-name

NAC policy to be assigned to the group policy. The NAC policy you name must be present in the configuration of the ASA. The show running-config nac-policy command displays the name and configuration of each NAC policy.

none

Removes the nac-policy-name from the group policy and disables the use of a NAC policy for this group policy. The group policy does not inherit the nac-settings value from the default group policy.

value

Assigns the NAC policy to be named to the group policy.

domain_name

Adds a name to the blacklist. You can enter this command multiple times for multiple entries. You can add up to 1000 blacklist entries.

description

(Optional) Specifies a description for the ip address name.

ip_address

Specifies an IP address of the host that is named.

name

Specifies the name assigned to the IP address. Use characters a to z, A to Z, 0 to 9, a dash, and an underscore. The name must be 63 characters or less. Also, the name cannot start with a number.

text

Specifies the text for the description.

name

Sets a name up to 48 characters in length. The name is not case-sensitive. Do not use the names “Metrics_History” or “MH”; they cause ASDM to show the interface in a down state.

symbol

(Optional) The character that separates the e-mail and VPN usernames and passwords. Choices are “@,” (at) “|” (pipe), “:”(colon), “#” (hash), “,” (comma), and “;” (semi-colon).

interface_name

(Optional) Specifies the interface name through which the ASA communicates with the server. If you do not specify the interface, the ASA checks the data routing table; if there are no matches, it then checks the management-only routing table.

ip_address

Specifies the DNS server IP address. You can specify up to six addresses as separate commands, or for convenience, up to six addresses in one command separated by spaces. If you enter multiple servers in one command, the ASA saves each server in a separate command in the configuration. The ASA tries each DNS server in order until it receives a response.

(Optional) Specifies the real and mapped interfaces. If you do not specify the real and mapped interfaces, all interfaces are used. You can also specify the keyword any for one or both of the interfaces. For bridge group member interfaces (in transparent or routed mode), you must specify the real and mapped interfaces; you cannot use any .

Because twice NAT can translate both the source and destination addresses, these interfaces are better understood to be the source and destination interfaces.

after-auto

Inserts the rule at the end of section 3 of the NAT table, after the network object NAT rules. By default, twice NAT rules are added to section 1. You can insert a rule anywhere in section 3 using the line argument.

any

(Optional) Specifies a wildcard value. The main uses for any are:

• Interfaces—You can use any for one or both interfaces ((any,outside) , for example). If you do not specify the interfaces, then any is the default. However, any does not apply to bridge group member interfaces, and any is not available in transparent mode.

• Static NAT source real and mapped IP addresses—You can specify source static any any to enable identity NAT for all addresses.

• Dynamic NAT or PAT source real addresses—You can translate all addresses on the source interface by specifying source dynamic any mapped_obj

For static NAT, although any is also available for the real source port/mapped destination port, or for the source or destination real address (without any as the mapped address), these uses might result in unpredictable behavior.

block-allocation

Enables port block allocation. For carrier-grade or large-scale PAT, you can allocate a block of ports for each host, rather than have NAT allocate one port translation at a time. If you allocate a block of ports, subsequent connections from the host use new randomly-selected ports within the block. If necessary, additional blocks are allocated if the host has active connections for all ports in the original block. Port blocks are allocated in the 1024-65535 range only. Port block allocation is compatible with round-robin , but you cannot use the extended or flat [include-reserve ] options. You also cannot use interface PAT fallback.

description desc

(Optional) Provides a description up to 200 characters.

destination

(Optional) Configures translation for the destination address. Although the main feature of twice NAT is the inclusion of the destination IP address, the destination address is optional. If you do specify the destination address, you can configure static translation for that address or just use identity NAT for it. You might want to configure twice NAT without a destination address to take advantage of some of the other qualities of twice NAT, including the use of network object groups for real addresses, or manually ordering of rules. For more information, see the CLI configuration guide.

dns

(Optional) Translates DNS replies. Be sure DNS inspection is enabled (inspect dns ) (it is enabled by default). You cannot configure the dns keyword if you configure a destination address. Do not use this option with PAT rules. See the CLI configuration guide for more information.

dynamic

Configures dynamic NAT or PAT for the source addresses. The destination translation is always static.

extended

(Optional) Enables extended PAT for a PAT pool. Extended PAT uses 65535 ports per service , as opposed to per IP address, by including the destination address and port in the translation information. Normally, the destination port and address are not considered when creating PAT translations, so you are limited to 65535 ports per PAT address. For example, with extended PAT, you can create a translation of 10.1.1.1:1027 when going to 192.168.1.7:23 as well as a translation of 10.1.1.1:1027 when going to 192.168.1.7:80.

flat [include-reserve ]

include-reserve

(Optional, pre-9.15) Enables use of the entire 1024 to 65535 port range when allocating ports. When choosing the mapped port number for a translation, the ASA uses the real source port number if it is available. However, without this option, if the real port is not available, by default the mapped ports are chosen from the same range of ports as the real port number: 1 to 511, 512 to 1023, and 1024 to 65535. To avoid running out of ports at the low ranges, configure this setting. To use the entire range of 1 to 65535, also specify the include-reserve keyword.

(9.15+) Starting with 9.15, flat is the default and unconfigurable behavior for a PAT pool. The include-reserve keyword is independent from the flat keyword, so you can still elect to include the reserved ports, 1-1023, in the PAT pool.

inactive

(Optional) To make this rule inactive without having to remove the command, use the inactive keyword. To reactivate it, reenter the whole command without the inactive keyword.

interface [ipv6 ]

(Optional) Uses the interface IP address as the mapped address. If you specify ipv6 , then the IPv6 address of the interface is used.

For the dynamic NAT source mapped address, if you specify a mapped object or group followed by the interface keyword, then the IP address of the mapped interface is only used if all other mapped addresses are already allocated.

For dynamic PAT, you can specify interface alone for the source mapped address.

For static NAT with port translation (source or destination), be sure to also configure the service keyword.

For this option, you must configure a specific interface for the mapped_ifc .

This option is not available in transparent mode. In routed mode, you cannot use this option if the destination interface is a bridge group member.

line

(Optional) Inserts a rule anywhere in section 1 of the NAT table. By default, the NAT rule is added to the end of section 1 (see the CLI configuration guide for more information). If you want to add the rule into section 3 instead (after the network object NAT rules), then use the after-auto line option.

mapped_dest_svc_obj

(Optional) For dynamic NAT/PAT, specifies the mapped destination port (the destination translation is always static). See the service keyword for more information.

mapped_object

Identifies the mapped network object or object group (object network or object-group network ).

For dynamic NAT, you typically configure a larger group of addresses to be mapped to a smaller group.

For dynamic PAT, configure a group of addresses to be mapped to a single address. You can either translate the real addresses to a single mapped address of your choosing, or you can translate them to the mapped interface address. If you want to use the interface address, do not configure a network object for the mapped address; instead use the interface keyword.

For static NAT, the mapping is typically one-to-one, so the real addresses have the same quantity as the mapped addresses. You can, however, have different quantities if desired. For more information, see the CLI configuration guide.

mapped_src_real_dest_svc_obj

(Optional) For static NAT, specifies the either the mapped source port, the real destination port, or both together. See the service keyword for more information.

net-to-net

(Optional) For static NAT 46, specify net-to-net to translate the first IPv4 address to the first IPv6 address, the second to the second, and so on. Without this option, the IPv4-embedded method is used. For a one-to-one translation, you must use this keyword.

no-proxy-arp

(Optional) For static NAT, disables proxy ARP for incoming packets to the mapped IP addresses.

pat-pool mapped_obj

(Optional) Enables a PAT pool of addresses; all addresses in the object are used as PAT addresses. For dynamic NAT, you can configure the PAT pool as a fallback method. You cannot use an object group with both IPv4 and IPv6 addresses; the object group must include only one type of address.

real_dest_svc_obj

(Optional) For dynamic NAT/PAT, specifies the real destination port (the destination translation is always static). See the service keyword for more information.

real_ifc

(Optional) Specifies the name of the interface where packets may originate. For source option. For the source option, the origin_ifc is the real interface. For the destination option, the real_ifc is the mapped interface.

real_object

Identifies the real network object or object group (object network or object-group network ). You cannot use an object group with both IPv4 and IPv6 addresses; the object group must include only one type of address.

real_src_mapped_dest_svc_obj

(Optional) For static NAT, specifies the either the real source port, the mapped destination port, or both together. See the service keyword for more information.

round-robin

(Optional) Enables round-robin address allocation for a PAT pool. By default, all ports for a PAT address will be allocated before the next PAT address is used. The round-robin method assigns an address/port from each PAT address in the pool before returning to use the first address again, and then the second address, and so on.

route-lookup

(Optional) For identity NAT in routed mode, determines the egress interface using a route lookup instead of using the interface specified in the NAT command. If you do not specify interfaces in the NAT command, a route lookup is used by default.

service

(Optional) Specifies the port translation.

• Dynamic NAT and PAT—Dynamic NAT and PAT do not support (additional) port translation. However, because the destination translation is always static, you can perform port translation for the destination port. A service object (object service ) can contain both a source and destination port, but only the destination port is used in this case. If you specify the source port, it will be ignored.

• Static NAT with port translation—You should specify either the source or the destination port for both service objects. You should only specify both the source and destination ports if your application uses a fixed source port (such as some DNS servers); but fixed source ports are rare.

For source port translation, the objects must specify the source service. The order of the service objects in the command in this case is service real_port mapped_port . For destination port translation, the objects must specify the destination service. The order of the service objects in this case is service mapped_port real_port . In the rare case where you specify both the source and destination ports in the object, the first service object contains the real source port/mapped destination port; the second service object contains the mapped source port/real destination port. See the “Usage Guidelines” section for more information about “source” and “destination” terminology.

For identity port translation, simply use the same service object for both the real and mapped ports (source and/or destination ports, depending on your configuration). The “not equal” (neq ) operator is not supported.

NAT only supports TCP or UDP. When translating a port, be sure the protocols in the real and mapped service objects are identical (both TCP or both UDP).

source

Configures translation for the source address.

static

Configures static NAT or static NAT with port translation.

unidirectional

(Optional) For static NAT, makes the translarion unidirection from the source to the destination; the destination addresses cannot initiate traffic to the source addresses. This option might be useful for testing purposes.

( real_ifc , mapped_ifc )

(Optional) For static NAT, specifies the real and mapped interfaces. If you do not specify the real and mapped interfaces, all interfaces are used. You can also specify the keyword any for one or both of the interfaces. Be sure to include the parentheses in your command. For bridge group member interfaces (in transparent or routed mode), you must specify the real and mapped interfaces; you cannot use any .

block-allocation

Enables port block allocation. For carrier-grade or large-scale PAT, you can allocate a block of ports for each host, rather than have NAT allocate one port translation at a time. If you allocate a block of ports, subsequent connections from the host use new randomly-selected ports within the block. If necessary, additional blocks are allocated if the host has active connections for all ports in the original block. Port blocks are allocated in the 1024-65535 range only. Port block allocation is compatible with round-robin , but you cannot use the extended or flat [include-reserve ] options. You also cannot use interface PAT fallback.

dns

(Optional) Translates DNS replies. Be sure DNS inspection (inspect dns ) is enabled (it is enabled by default). This option is not available if you specify the service keyword (for static NAT). Do not use this option with PAT rules. For more information, see the CLI configuration guide.

dynamic

Configures dynamic NAT or PAT.

extended

(Optional) Enables extended PAT for a PAT pool. Extended PAT uses 65535 ports per service , as opposed to per IP address, by including the destination address and port in the translation information. Normally, the destination port and address are not considered when creating PAT translations, so you are limited to 65535 ports per PAT address. For example, with extended PAT, you can create a translation of 10.1.1.1:1027 when going to 192.168.1.7:23 as well as a translation of 10.1.1.1:1027 when going to 192.168.1.7:80.

flat [include-reserve ]

include-reserve

(Optional, pre-9.15) Enables use of the entire 1024 to 65535 port range when allocating ports. When choosing the mapped port number for a translation, the ASA uses the real source port number if it is available. However, without this option, if the real port is not available, by default the mapped ports are chosen from the same range of ports as the real port number: 1 to 511, 512 to 1023, and 1024 to 65535. To avoid running out of ports at the low ranges, configure this setting. To use the entire range of 1 to 65535, also specify the include-reserve keyword.

(9.15+) Starting with 9.15, flat is the default and unconfigurable behavior for a PAT pool. The include-reserve keyword is independent from the flat keyword, so you can still elect to include the reserved ports, 1-1023, in the PAT pool.

interface [ipv6 ]

(Optional) For dynamic NAT, if you specify a mapped IP address, object, or group followed by the interface keyword, then the IP address of the mapped interface is only used if all of the other mapped addresses are already allocated.

For dynamic PAT, if you specify the interface keyword instead of a mapped IP address, object, or group, then you use the interface IP address for the mapped IP address. You must use this keyword when you want to use the interface IP address; you cannot enter it inline or as an object.

If you specify ipv6 , then the IPv6 address of the interface is used.

For static NAT with port translation, you can specify the interface keyword if you also configure the service keyword.

For this option, you must configure a specific interface for the mapped_ifc .

You cannot specify interface in transparent mode. In routed mode, you cannot use this option if the destination interface is a bridge group member.

mapped_inline_host_ip

If you specify dynamic , then using a host IP address configures dynamic PAT. If you specify static , the netmask or range for the mapped network is the same as that of the real network. For example, if the real network is a host, then this address will be treated as a host address. In the case of a range or subnet, then the mapped addresses include the same number of addresses as the real range or subnet. For example, if the real address is defined as a range from 10.1.1.1 through 10.1.1.6, and you specify 172.20.1.1 as the mapped address, then the mapped range will include 172.20.1.1 through 172.20.1.6. If you want a many-to-one mapping, which we do not recommend, use a host network object instead of an inline address.

mapped_obj

Specifies the mapped IP address(es) as a network object (object network ) or object group (object-group network ). You cannot use an object group with both IPv4 and IPv6 addresses; the object group must include only one type of address.

For dynamic NAT, the object or group cannot contain a subnet. You can share this mapped object across different dynamic NAT rules, if desired. See the "Mapped Address Guidelines" for information about disallowed mapped IP addresses.

For static NAT, typically you configure the same number of mapped addresses as real addresses for a one-to-one mapping. You can, however, have a mismatched number of addresses. For more information, see the CLI configuration guide.

mapped_port

(Optional) Specifies the mapped TCP/UDP/SCTP port. You can specify ports by either a literal name or a number in the range of 0 to 65535.

net-to-net

(Optional) For NAT 46, specify net-to-net to translate the first IPv4 address to the first IPv6 address, the second to the second, and so on. Without this option, the IPv4-embedded method is used. For a one-to-one translation, you must use this keyword.

no-proxy-arp

(Optional) For static NAT, disables proxy ARP for incoming packets to the mapped IP addresses.

pat-pool mapped_obj

(Optional) Enables a PAT pool of addresses; all addresses in the object are used as PAT addresses. For dynamic NAT, you can configure the PAT pool as a fallback method. You cannot use an object group with both IPv4 and IPv6 addresses; the object group must include only one type of address.

real_port

(Optional) For static NAT, specifies the real TCP/UDP/SCTP port. You can specify ports by either a literal name or a number in the range of 0 to 65535.

round-robin

(Optional) Enables round-robin address allocation for a PAT pool. By default, all ports for a PAT address will be allocated before the next PAT address is used. The round-robin method assigns an address/port from each PAT address in the pool before returning to use the first address again, and then the second address, and so on.

route-lookup

(Optional) For identity NAT in routed mode, determines the egress interface using a route lookup instead of using the interface specified in the NAT command. If you do not specify interfaces in the NAT command, a route lookup is used by default.

service {tcp | udp | sctp }

(Optional) For static NAT with port translation, specifies the protocol for port translation: TCP, UDP, SCTP.

static

Configures static NAT or static NAT with port translation.

ip-address

The IP address to which you want this NAT to translate the IP address of this device.

interface

Specifies the interface where you want to apply NAT.

hostname

Specifies the hostname for the NBNS server.

ipaddr

Specifies the IP address for the NBNS server.

master

Indicates that this is a master browser, rather than a WINS server.

retry

Indicates that a retry value follows.

retries

Specifies the number of times to retry queries to NBNS servers. The ASA recycles through the list of servers the number of times you specify here before sending an error message. The default value is 2; the range is 1 through 10.

timeout

Indicates that a timeout value follows.

timeout

Specifies the amount of time the ASA waits before sending the query again, to the same server if there is only one, or another server if there are multiple NBNS servers. The default timeout is 2 seconds; the range is 1 to 30 seconds.

interface name

The interface name, as specified by the nameif command, through which the neighbor can be reached.

ip_address

IPv4 or IPv6 address of the neighbor router with which routing information is exchanged.

interface name

(Optional) Specifies the interface name, as specified by the nameif command, through which the neighbor can be reached.

ip_address

Specifies the IP address of the neighbor router.

ipv4_address

Specifies the IPv4 address of the router that should receive conditional advertisements.

ipv6_address

Specifies the IPv6 address of the router that should receive conditional advertisements.

advertise-map map-name

Specifies the name of the route map that will be advertised if the conditions of the exist map or non-exist map are met.

exist-map map-name

Specifies the name of the exist-map that is compared with the routes in the BGP table to determine whether the advertise-map route is advertised or not.

non-exist-map map-name

Specifies the name of the non-exist-map that is compared with the routes in the BGP table to determine whether the advertise-map route is advertised or not.

check-all-paths

(Optional) Enables checking of all paths by the exist-map with a prefix in the BGP table.

ip_address

IP address of the neighbor router.

ipv6-address

IPv6 address of the neighbor router

seconds

Minimum time interval between sending BGP routing updates.

Valid values are between 0 and 600.

ip_address

IP address of the neighbor router.

ipv6-address

IPv6 address of the neighbor router.

route-map route-map name

(Optional) Name of the route map. The route map allows route 0.0.0.0 to be injected conditionally.

ip_address

IP address of the neighbor router.

ipv6-address

IPv6 address of the neighbor router.

text

Text (up to 80 characters in length) that describes the neighbor.

ip_address

IP address of the neighbor router.

ipv6-address

IPv6 address of the neighbor router.

ip_address

IP address of the neighbor router.

access-list-name

Name of a standard access list.

in

Access list is applied to incoming advertisements to that neighbor

out

Access list is applied to outgoing advertisements to that neighbor

ip_address

IP address of the neighbor router.

ipv6-address

IPv6 address of the neighbor router.

ttl

(Optional) Time to live.

Valid values are between 1 and 255 hops.

ip_address/ipv6_address

IP/IPv6 address of the neighbor router A.B.C.D/ X:X:X:X::X format.

ip_address

IP address of the neighbor router.

ipv6-address

IPv6 address of the neighbor router.

access-list-name

Name of an autonomous system path access list. You define this access list with the as-path access-list command.

in

Access list is applied to incoming routes.

out

Access list is applied to outgoing routes.

ip_address

IP address of the neighbor.

disable

(Optional) Disables BGP graceful restart capability for a neighbor.

ip_address

IP address of the neighbor router.

ipv6-address

IPv6 address of the neighbor router.

autonomous-system-number

(Optional) Number of an autonomous system to prepend to the AS_PATH attribute. The range of values for this argument is any valid autonomous system number from 1 to 65535.

For more details about autonomous system number formats, see the router bgp command.

no-prepend

(Optional) Does not prepend the local autonomous system number to any routes received from the eBGP neighbor.

replace-as

(Optional) Replaces the real autonomous system number with the local autonomous system number in the eBGP updates. The autonomous system number from the local BGP routing process is not prepended.

dual-as

(Optional) Configures the eBGP neighbor to establish a peering session using the real autonomous system number (from the local BGP routing process) or by using the autonomous system number configured with the autonomous-system-number argument (local-as).

ip_address

IP address of the neighbor router.

ipv6-address

IPv6 address of the neighbor router.

maximum

Maximum number of prefixes allowed from this neighbor.

threshold

(Optional) Integer specifying at what percentage of maximum the router starts to generate a warning message. The range is from 1 to 100; the default is 75 (percent).

restart

(Optional) Configures the router that is running BGP to automatically reestablish a peering session that has been disabled because the maximum-prefix limit has been exceeded. The restart timer is configured with the restart-interval argument.

restart-interval

(Optional) Time interval (in minutes) that a peering session is reestablished. The range is from 1 to 65535 minutes.

warning-only

(Optional) Allows the router to generate a log message when the maximum is exceeded, instead of terminating the peering.