Nat Types; Dynamic Nat - Cisco PIX 500 Series Configuration Manual

NAT Overview

NAT Types

This section describes the available NAT types, and includes the following topics:
•
•
•
•
•
You can implement address translation as dynamic NAT, Port Address Translation, static NAT, static
PAT, or as a mix of these types. You can also configure rules to bypass NAT; for example, to enable NAT
control when you do not want to perform NAT.

Dynamic NAT

Dynamic NAT translates a group of real addresses to a pool of mapped addresses that are routable on the
destination network. The mapped pool may include fewer addresses than the real group. When a host
you want to translate accesses the destination network, the security appliance assigns the host an IP
address from the mapped pool. The translation is added only when the real host initiates the connection.
The translation is in place only for the duration of the connection, and a given user does not keep the
same IP address after the translation times out. For an example, see the timeout xlate command in the
Cisco Security Appliance Command Reference. Users on the destination network, therefore, cannot
initiate a reliable connection to a host that uses dynamic NAT, although the connection is allowed by an
access list, and the security appliance rejects any attempt to connect to a real host address directly. See
the
In some cases, a translation is added for a connection, although the session is denied by the security
Note
appliance. This condition occurs with an outbound access list, a management-only interface, or a backup
interface in which the translation times out normally. For an example, see the show xlate command in
the Cisco Security Appliance Command Reference.
Figure 17-6
because the security appliance only allows returning connections to the mapped address.
Cisco Security Appliance Command Line Configuration Guide
17-6
Dynamic NAT, page 17-6
PAT, page 17-8
Static NAT, page 17-8
Static PAT, page 17-9
Bypassing NAT When NAT Control is Enabled, page 17-10
"Static NAT" or "Static PAT"
shows a remote host attempting to connect to the real address. The connection is denied,
section for information on how to obtain reliable access to hosts.
Chapter 17 Configuring NAT
OL-12172-03