Nat Types; Dynamic Nat - Cisco 7604 Configuration Manual

NAT Overview
If you want the added security of NAT control but do not want to translate inside addresses in some cases,
you can apply a NAT exemption or identity NAT rule on those addresses. (See the
section on page 16-33
To configure NAT control, see the
Note In multiple context mode, the packet classifier relies on the NAT configuration in some cases to assign
packets to contexts. If you do not perform NAT because NAT control is disabled, then the classifier might
require changes in your network configuration. See the
page 4-3

NAT Types

This section describes the available NAT types. You can implement address translation as dynamic NAT,
Port Address Translation (PAT is also known as NAT overloading), static NAT, or static PAT or as a mix
of these types. You can also configure rules to bypass NAT, for example, if you enable NAT control but
do not want to perform NAT. This section includes the following topics:
•
•
•
•
•

Dynamic NAT

Dynamic NAT translates a group of real addresses to a pool of mapped addresses that are routable on the
destination network. The mapped pool can include fewer addresses than the real group. When a host you
want to translate accesses the destination network, the FWSM assigns it an IP address from the mapped
pool. The translation is added only when the real host initiates the connection. The translation is in place
only for the duration of the connection, and a given user does not keep the same IP address after the
translation times out. (See the timeout xlate command in the Catalyst 6500 Series Switch and Cisco
7600 Series Router Firewall Services Module Command Reference.) Users on the destination network,
therefore, cannot reliably initiate a connection to a host that uses dynamic NAT (even if the connection
is allowed by an access list), and the FWSM rejects any attempt to connect to a real host address directly.
See the following
Figure 16-6
because the FWSM only allows returning connections to the mapped address.
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
16-6
for more information.)
for more information about the relationship between the classifier and NAT.
Dynamic NAT, page 16-6
PAT, page 16-8
Static NAT, page 16-8
Static PAT, page 16-9
Bypassing NAT when NAT Control is Enabled, page 16-10
"Static NAT"
shows a remote host attempting to connect to the real address. The connection is denied
"Configuring NAT Control" section on page
"How the FWSM Classifies Packets" section on
or "Static PAT" sections for reliable access to hosts.
Chapter 16 Configuring NAT
"Bypassing NAT"
16-18.
OL-20748-01