This post builds upon the previous discussions on the ASA NAT series to exemplify yet another category of address translation: Dynamic Policy PAT. In this type of scenario, a set of source addresses get mapped into a single global address when they need to reach specific destinations.
In our reference topology, those dmz stations belonging to the 10.10.10.128/27 subnet are port address translated to 172.16.16.125/32 when the destination is the out host 172.16.16.200. For different out hosts, the source IPs are not translated. Some important points to highlight:
- It is important to observe that we are not translating the destination address. We are just using the destination criteria to influence translation of the source addresses.
- In the pre-8.3 CLI the number “1” is the NAT_ID, which creates the relationship between the nat and global commands.
- The original syntax (pre-8.3) employs an Access Control List (ACL) in conjunction with the nat command to insert the destination-based rule.
- In the new model introduced by release 8.3, we use manual NAT to create any rules that concurrently involve source and destination. This is the case for Policy NAT, Policy PAT and Dual NAT. Unless you use the after-auto argument in the nat command, manual translations are inserted in Section 1 of the Unified NAT Table.
- As in the basic PAT case (which does not take destination addresses into account), ASA combines the global address (172. 16.16.125 in this case) with a source port to correctly identify each internal host and deliver the return packets accordingly.
- Manual NAT allows you to add a sequence number to each manual nat statement, so that you can directly control the order of processing of the translation rules (irrespectively of the NAT category in place). This is a major difference when comparing to releases up to 8.2, for which you needed to know the intrinsic NAT precedence rules.
** Topics for Study:
- nat command (complete syntax options for manual NAT)http://www.cisco.com/en/US/docs/security/asa/asa84/command/reference/no.html#wp1792563
- It is highly recommended that you get familiar with the “show running nat”, “show running object” and “show nat interface” commands.
** Related Posts:
- NAT Series: http://alexandremspmoraes.wordpress.com/tag/nat/