Configuring Nat Exemption - Cisco FirePOWER ASA 5500 series Configuration Manual

Chapter 17 Applying NAT
The following command uses static identity NAT for an outside address (209.165.201.15) when accessed
by the inside:
hostname(config)# static (outside,inside) 209.165.201.15 209.165.201.15 netmask
255.255.255.255
The following command statically maps an entire subnet:
hostname(config)# static (inside,dmz) 10.1.2.0 10.1.2.0 netmask 255.255.255.0
The following static identity policy NAT example shows a single real address that uses identity NAT
when accessing one destination address, and a translation when accessing another:
hostname(config)# access-list NET1 permit ip host 10.1.2.27 209.165.201.0 255.255.255.224
hostname(config)# access-list NET2 permit ip host 10.1.2.27 209.165.200.224
255.255.255.224
hostname(config)# static (inside,outside) 10.1.2.27 access-list NET1
hostname(config)# static (inside,outside) 209.165.202.130 access-list NET2

Configuring NAT Exemption

NAT exemption exempts addresses from translation and allows both real and remote hosts to originate
connections. NAT exemption lets you specify the real and destination addresses when determining the
real traffic to exempt (similar to policy NAT), so you have greater control using NAT exemption than
identity NAT. However unlike policy NAT, NAT exemption does not consider the ports in the access list.
Use static identity NAT to consider ports in the access list.
Figure 17-25
Figure 17-25
209.165.201.1
209.165.201.2
Note If you remove a NAT exemption configuration, existing connections that use NAT exemption are not
affected. To remove these connections, enter the clear local-host command.
To configure NAT exemption, enter the following command:
hostname(config)# nat (real_interface) 0 access-list acl_name [outside] [norandomseq]
[[tcp] tcp_max_conns [emb_limit]] [udp udp_max_conns]
Create the access list using the access-list command (see the
on page
and destination ports in the access list; NAT exemption does not consider the ports. NAT exemption also
does not consider the inactive or time-range keywords; all ACEs are considered to be active for
NAT exemption configuration.
OL-10088-01
shows a typical NAT exemption scenario.
NAT Exemption
Security
Appliance
209.165.201.1
209.165.201.2
Inside Outside
16-5). This access list can include both permit ACEs and deny ACEs. Do not specify the real
"Adding an Extended Access List" section
Cisco Security Appliance Command Line Configuration Guide
Bypassing NAT
17-31