Cisco ASA 5506-X Configuration Manual page 86

Static NAT
hostname(config)# object network my-mapped-obj
hostname(config-network-object)# host 10.2.2.2
hostname(config-network-object)# object network my-host-obj1
hostname(config-network-object)# host 10.1.1.1
hostname(config-network-object)# nat (inside,outside) static my-mapped-obj
The following example configures static NAT-with-port-translation for 10.1.1.1 at TCP port 21 to the
outside interface at port 2121.
hostname(config)# object network my-ftp-server
hostname(config-network-object)# host 10.1.1.1
hostname(config-network-object)# nat (inside,outside) static interface service tcp 21 2121
The following example maps an inside IPv4 network to an outside IPv6 network.
hostname(config)# object network inside_v4_v6
hostname(config-network-object)# subnet 10.1.1.0 255.255.255.0
hostname(config-network-object)# nat (inside,outside) static 2001:DB8::/96
The following example maps an inside IPv6 network to an outside IPv6 network.
hostname(config)# object network inside_v6
hostname(config-network-object)# subnet 2001:DB8:AAAA::/96
hostname(config-network-object)# nat (inside,outside) static 2001:DB8:BBBB::/96
Configure Static Twice NAT or Static NAT-with-Port-Translation
This section describes how to configure a static NAT rule using twice NAT.
Procedure
Create host or range network objects (object network command), or network object groups
Step 1
(object-group network command), for the source real addresses, the source mapped addresses, the
destination real addresses, and the destination mapped addresses.
•
•
If you do create objects, consider the following guidelines:
•
•
(Optional.) Create service objects for the:
Step 2
•
•
Cisco ASA Series Firewall CLI Configuration Guide
4-34
If you want to configure source static interface NAT with port translation only, you can skip adding
an object for the source mapped addresses, and instead specify the interface keyword in the nat
command.
If you want to configure destination static interface NAT with port translation only, you can skip
adding an object for the destination mapped addresses, and instead specify the interface keyword
in the nat command.
The mapped object or group can contain a host, range, or subnet.
The static mapping is typically one-to-one, so the real addresses have the same quantity as the
mapped addresses. You can, however, have different quantities if desired. For more information, see
Static NAT, page 4-27.
Source or Destination real ports
Source or Destination mapped ports
Chapter 4 Network Address Translation (NAT