In this article, we will take a look at how to configure different types of NAT on the Cisco ASA post 8.4 software code. Accompanying this post is a video demonstration covering what has been discussed in this article.
-
Static NAT
-
Dynamic NAT
-
Dynamic PAT
-
Identity NAT
-
Inside local address: This is the IP address that is assigned to a host on the inside of a network. The inside local address is most certainly bound to fall within the RFC 1918 reserved private IP address spaces.
-
Inside global address: This is a globally routable IP address (public IP address) that can represent one or more inside local IP addresses to the outside world.
-
Outside local address: This is the IP address of an outside host as it appears on the inside network.
-
Outside global address: This is the IP address that is assigned to a host or hosts on the outside network. The outside global address is allocated from a globally routable address or network space (public IP address).
-
Object NAT cannot be configured under Object Groups however they can be referred to when configuring twice NAT
-
NAT is supported for both Routed and Transparent mode deployments
-
Object networks and groups can only include IPv4 or IPv6 addresses and cannot have both
-
As per the NAT order of operation, Twice NAT rules will be considered before Object NAT (shown below)
Static NAT


nat (inside,outside) static VPC3-Mapped
ciscoasa(config)# show nat detail
Auto NAT Policies (Section 2)
1 (inside) to (outside) source static VPC3 VPC3-Mapped
translate_hits = 10, untranslate_hits = 5
Source – Origin: 192.168.10.10/32, Translated: 206.206.206.1/32
Dynamic NAT

ciscoasa(config)# show nat detail
Manual NAT Policies (Section 1)
1 (inside) to (outside) source dynamic VPC4-5 dynamic-nat translate_hits = 67, untranslate_hits = 0
Source – Origin: 192.168.10.11/32, 192.168.10.12/32, Translated: 206.206.206.2-206.206.206.4
Dynamic PAT
ciscoasa(config-network-object)# range 206.206.206.5 206.206.206.10
!
ciscoasa(config)# object network IPv4_POOL
Identity NAT
An example of dynamic PAT configuration is shown below:
translate_hits = 0, untranslate_hits = 0
Source – Origin: 192.168.10.10/32, Translated: 192.168.10.10/32