Cisco ASA Series Cli Configuration Manual page 753

Chapter 1 Information About NAT
Figure 1-5
Figure 1-5
10.1.2.27
10.1.2.28
10.1.2.29
10.1.2.30
10.1.2.31
Instead of using a static rule this way, we suggest that you create a one-to-one rule for the traffic that
needs bidirectional initiation, and then create a dynamic rule for the rest of your addresses.
Dynamic NAT
This section describes dynamic NAT and includes the following topics:
•
•
Information About Dynamic NAT
Dynamic NAT translates a group of real addresses to a pool of mapped addresses that are routable on the
destination network. The mapped pool typically includes fewer addresses than the real group. When a
host you want to translate accesses the destination network, the ASA assigns the host an IP address from
the mapped pool. The translation is created only when the real host initiates the connection. The
translation is in place only for the duration of the connection, and a given user does not keep the same
IP address after the translation times out. Users on the destination network, therefore, cannot initiate a
reliable connection to a host that uses dynamic NAT, even if the connection is allowed by an access rule.
Figure 1-6
responding traffic is allowed back.
Figure 1-6
10.1.1.1
10.1.1.2
shows a typical many-to-few static NAT scenario.
Many-to-Few Static NAT
Security
Appliance
209.165.201.3
209.165.201.4
209.165.201.3
209.165.201.4
209.165.201.3
Inside Outside
Information About Dynamic NAT, page 1-7
Dynamic NAT Disadvantages and Advantages, page 1-8
shows a typical dynamic NAT scenario. Only real hosts can create a NAT session, and
Dynamic NAT
Security
Appliance
209.165.201.1
209.165.201.2
Inside Outside
Cisco ASA Series CLI Configuration Guide
NAT Types
1-7