Configuring Dynamic NAT or PAT

10.1.1.1:1025

209.165.201.1:2020

10.1.1.1:1026

209.165.201.1:2021

10.1.1.2:1025

209.165.201.1:2022

Inside /Outside

Note

For more information about dynamic NAT, see the "Dynamic NAT" section on page 17-5. For more information about PAT, see the "PAT" section on page 17-7.

If you change the NAT configuration, and you do not want to wait for existing translations to time out before the new NAT information is used, you can clear the translation table using the clear xlate command. However, clearing the translation table disconnects all current connections that use translations.

To configure dynamic NAT or PAT, perform the following steps:

Step 1 To identify the real addresses that you want to translate, enter one of the following commands:

hostname(config)# nat (real_interface) nat_id access-list acl_name [dns] [outside] [norandomseq] [[tcp] tcp_max_conns [emb_limit]] [udp udp_max_conns]

You can identify overlapping addresses in other nat commands. For example, you can identify 10.1.1.0 in one command, but 10.1.1.1 in another. The traffic is matched to a policy NAT command in order, until the first match, or for regular NAT, using the best match.

See the following description about options for this command:

- access-list acl_name—Identify the real addresses and destination addresses using an extended access list. Create the access list using the access-list command (see the "Adding an Extended Access List" section on page 16-5). This access list should include only permit ACEs. You can optionally specify the real and destination ports in the access list using the eq operator. Policy NAT does not consider the inactive or time-range keywords; all ACEs are considered to be active for policy NAT configuration.

- nat_id—An integer between 1 and 65535. The NAT ID should match a global command NAT ID. See the "Dynamic NAT and PAT Implementation" section on page 17-16 for more information about how NAT IDs are used. 0 is reserved for NAT exemption. (See the "Configuring NAT Exemption" section on page 17-31 for more information about NAT exemption.)

- dns—If your nat command includes the address of a host that has an entry in a DNS server, and the DNS server is on a different interface from a client, then the client and the DNS server need different addresses for the host; one needs the mapped address and one needs the real address. This option rewrites the address in the DNS reply to the client. The translated host needs to be on the same interface as either the client or the DNS server. Typically, hosts that need to allow access from other interfaces use a static translation, so this option is more likely to be used with the static command. (See the "DNS and NAT" section on page 17-14 for more information.)

- outside—If this interface is on a lower security level than the interface you identify by the matching global statement, then you must enter outside to identify the NAT instance as outside NAT.

- norandomseq, tcp tcp_max_conns, udp udp_max_conns, and emb_limit—These keywords set connection limits. However, we recommend using a more versatile method for setting connection limits; see the "Configuring Connection Limits and Timeouts" section on page 23-6.

hostname(config)# nat (real_interface) nat_id real_ip [mask [dns] [outside] [norandomseq] [[tcp] tcp_max_conns [emb_limit]] [udp udp_max_conns]]

The nat_id is an integer between 1 and 2147483647. The NAT ID must match a global command NAT ID. See the "Dynamic NAT and PAT Implementation" section on page 17-16 for more information about how NAT IDs are used. 0 is reserved for identity NAT. See the "Configuring Identity NAT" section on page 17-29 for more information about identity NAT.

See the preceding policy NAT command for information about other options.

Step 2 To identify the mapped address(es) to which you want to translate the real addresses when they exit a particular interface, enter the following command:

hostname(config)# global (mapped_interface) nat_id {mapped_ip[-mapped_ip] | interface}

This NAT ID should match a nat command NAT ID. The matching nat command identifies the addresses that you want to translate when they exit this interface.

You can specify a single address (for PAT) or a range of addresses (for NAT). The range can go across subnet boundaries if desired. For example, you can specify the following "supernet":

192.168.1.1-192.168.2.254

For example, to translate the 10.1.1.0/24 network on the inside interface, enter the following command:

hostname(config)# nat (inside) 1 10.1.1.0 255.255.255.0 hostname(config)# global (outside) 1 209.165.201.1-209.165.201.30

To identify a pool of addresses for dynamic NAT as well as a PAT address for when the NAT pool is exhausted, enter the following commands:

hostname(config)# nat (inside) 1 10.1.1.0 255.255.255.0 hostname(config)# global (outside) 1 209.165.201.5

hostname(config)# global (outside) 1 209.165.201.10-209.165.201.20

To translate the lower security dmz network addresses so they appear to be on the same network as the inside network (10.1.1.0), for example, to simplify routing, enter the following commands:

hostname(config)# nat (dmz) 1 10.1.2.0 255.255.255.0 outside dns hostname(config)# global (inside) 1 10.1.1.45

To identify a single real address with two different destination addresses using policy NAT, enter the following commands (see Figure 17-8 on page 17-10 for a related figure):

hostname(config)# access-list NET1 permit ip 10.1.2.0 255.255.255.0 209.165.201.0 255.255.255.224

hostname(config)# access-list NET2 permit ip 10.1.2.0 255.255.255.0 209.165.200.224 255.255.255.224

hostname(config)# nat (inside) 1 access-list NET1 tcp 0 2000 udp 10000 hostname(config)# global (outside) 1 209.165.202.129

hostname(config)# nat (inside) 2 access-list NET2 tcp 1000 500 udp 2000 hostname(config)# global (outside) 2 209.165.202.130

To identify a single real address/destination address pair that use different ports using policy NAT, enter the following commands (see Figure 17-9 on page 17-11 for a related figure):

hostname(config)# access-list WEB permit tcp 10.1.2.0 255.255.255.0 209.165.201.11 255.255.255.255 eq 80

hostname(config)# access-list TELNET permit tcp 10.1.2.0 255.255.255.0 209.165.201.11 255.255.255.255 eq 23

hostname(config)# nat (inside) 1 access-list WEB hostname(config)# global (outside) 1 209.165.202.129 hostname(config)# nat (inside) 2 access-list TELNET hostname(config)# global (outside) 2 209.165.202.130