Dynamic PAT Configuration on Cisco ASA

One of key features associated with Cisco ASA firewall is to NAT. Over the time ASA has come up with new versions and NAT has been fine-tuned with new sorts and commands.

Below is the configuration example where Dynamic PAT (NAT Overload) has been configured on the Firewall when LAN users are translated to Public IP (Interface IP or IP from Public Pool).

This type of Dynamic NAT/PAT configuration is used to provide internet access to LAN Users  by translating LAN Subnet with Outside Interface of Firewall or any Public IP address. This type of NAT only allows flows to be initiated from inside LAN towards Outside. Any traffic generated from Outside Zone will not be translated in this dynamic PAT setup.

Note – For test scenario we are considering subnet 192.168.2.0/24 as Private IP Pool while 192.168.1.0/24 as Public IP Pool.

 

Dynamic PAT for ASA version 8.3 and earlier –

NAT Translation for Source 192.168.2.0/24 with WAN Interface –

nat (inside) 1 192.168.2.0 255.255.255.0

global (outside) 1 interface

NAT Translation for Source 192.168.2.0/24 with Public IP –

nat (inside) 1 192.168.2.0 255.255.255.0

global (outside) 1 192.168.1.21

 

Dynamic PAT for ASA version 8.4 onwards –

NAT Translation for Source 192.168.2.0/24 with WAN Interface –

ASA(config)# object network NET-192.168.2.0

ASA(config-network-object)# subnet 192.168.2.0 255.255.255.0

ASA(config-network-object)# nat (inside,outside) dynamic interface

NAT Translation for Source 192.168.2.0/24 with Public IP –

ASA(config)# object network NET-192.168.2.0

ASA(config-network-object)# subnet 192.168.2.0 255.255.255.0

ASA(config-network-object)# nat (inside,outside) dynamic 192.168.1.21

 

Verification –

Following command on ASA Firewall provides output on NAT translations on source and NAtted IPs and port details –

ASA# show xlate ?

count     Show translation count

global     Enter this keyword to specify global ip range

gport     Enter this keyword to specify global port(s)

interface Enter this keyword to specify an interface

local     Enter this keyword to specify local ip range

lport     Enter this keyword to specify local port(s)

type       Enter this keyword to specify xlate type

|         Output modifiers

<cr>




Please follow and like us:

Related Post

Comments

comments

Add a Comment