Using Static NAT

10.1.1.1

■g m

209.165.201.1

10.1.1.2

WA

209.165.201.2

Inside /Outside

You cannot use the same real or mapped address in multiple static commands between the same two interfaces. Do not use a mapped address in the static command that is also defined in a global command for the same mapped interface.

For more information about static NAT, see the "Static NAT" section on page 17-7. % _

Note If you remove a static command, existing connections that use the translation are not affected. To remove these connections, enter the clear local-host command.

You cannot clear static translations from the translation table with the clear xlate command; you must remove the static command instead. Only dynamic translations created by the nat and global commands can be removed with the clear xlate command.

To configure static NAT, enter one of the following commands.

• For policy static NAT, enter the following command:

hostname(config)# static (real_interface,mapped_interface) {mapped_ip | interface} access-list acl_name [dns] [norandomseq] [[tcp] tcp_max_conns [emb_limit]] [udp udp_max_conns]

Create the access list using the access-list command (see the "Adding an Extended Access List" section on page 16-5). This access list should include only permit ACEs. The source subnet mask used in the access list is also used for the mapped addresses. You can also specify the real and destination ports in the access list using the eq operator. Policy NAT does not consider the inactive or time-range keywords; all ACEs are considered to be active for policy NAT configuration. See the "Policy NAT" section on page 17-9 for more information.

If you specify a network for translation (for example, 10.1.1.0 255.255.255.0), then the security appliance translates the .0 and .255 addresses. If you want to prevent access to these addresses, be sure to configure an access list to deny access.

See the "Configuring Dynamic NAT or PAT" section on page 17-22 for information about the other options.

• To configure regular static NAT, enter the following command:

hostname(config)# static (real_interface, mapped_interface) {mapped_ip | interface} real_ip [netmask mask] [dns] [norandomseq] [[tcp] tcp_max_conns [emb_limit]] [udp udp_max_conns]

See the "Configuring Dynamic NAT or PAT" section on page 17-22 for information about the options.

For example, the following policy static NAT example shows a single real address that is translated to two mapped addresses depending on the destination address (see Figure 17-8 on page 17-10 for a related figure):

hostname(config)# access-list NET1 permit ip host 10.1.2.27 209.165.201.0 255.255.255.224 hostname(config)# access-list NET2 permit ip host 10.1.2.27 209.165.200.224 255.255.255.224

hostname(config)# static (inside,outside) 209.165.202.129 access-list NET1 hostname(config)# static (inside,outside) 209.165.202.130 access-list NET2

The following command maps an inside IP address (10.1.1.3) to an outside IP address (209.165.201.12):

hostname(config)# static (inside,outside) 209.165.201.12 10.1.1.3 netmask 255.255.255.255

The following command maps the outside address (209.165.201.15) to an inside address (10.1.1.6):

hostname(config)# static (outside,inside) 10.1.1.6 209.165.201.15 netmask 255.255.255.255

The following command statically maps an entire subnet:

hostname(config)# static (inside,dmz) 10.1.1.0 10.1.2.0 netmask 255.255.255.0