Cisco ASA 5506-X Configuration Manual page 84

Static NAT
The following figure shows a typical many-to-few static NAT scenario.
Figure 4-11
10.1.2.27
10.1.2.28
10.1.2.29
10.1.2.30
10.1.2.31
Instead of using a static rule this way, we suggest that you create a one-to-one rule for the traffic that
needs bidirectional initiation, and then create a dynamic rule for the rest of your addresses.
Configure Static Network Object NAT or Static NAT-with-Port-Translation
This section describes how to configure a static NAT rule using network object NAT.
Procedure
(Optional.) Create a network object (object network command), or a network object group
Step 1
(object-group network command), for the mapped addresses.
•
•
Create or edit the network object for which you want to configure NAT.
Step 2
object network obj_name
Example
hostname(config)# object network my-host-obj1
Step 3 (Skip when editing an object that has the right address.) Define the real IPv4 or IPv6 addresses that you
want to translate.
•
•
•
Example
hostname(config-network-object)# subnet 10.2.1.0 255.255.255.0
Configure static NAT for the object IP addresses. You can only define a single NAT rule for a given
Step 4
object.
Cisco ASA Series Firewall CLI Configuration Guide
4-32
Many-to-Few Static NAT
Security
Appliance
209.165.201.3
209.165.201.4
209.165.201.3
209.165.201.4
209.165.201.3
Inside Outside
Instead of using an object, you can configure an inline address or specify the interface address (for
static NAT-with-port-translation).
If you use an object, the object or group can contain a host, range, or subnet.
host {IPv4_address | IPv6_address}—The IPv4 or IPv6 address of a single host. For example,
10.1.1.1 or 2001:DB8::0DB8:800:200C:417A.
subnet {IPv4_address IPv4_mask | IPv6_address/IPv6_prefix}—The address of a network. For
IPv4 subnets, include the mask after a space, for example, 10.0.0.0 255.0.0.0. For IPv6, include the
address and prefix as a single unit (no spaces), such as 2001:DB8:0:CD30::/60.
range start_address end_address—A range of addresses. You can specify IPv4 or IPv6 ranges. Do
not include masks or prefixes.
Chapter 4 Network Address Translation (NAT