Network Warrior, 2nd Edition

NAT

Network Address Translation (NAT) is technically what Cisco refers to as translating one IP address to another. The majority of installations, including most home networks, translate many IP addresses to a single address. This is actually called Port Address Translation (PAT). PAT has also been called NAT Overload in IOS.

To complicate matters, in the ASA, NAT is used in a number of ways that may not seem obvious. For example, you may have to use a nat statement to allow packets from one interface to another, even though they both have public IP addresses and would normally require no translation.

NAT Commands

A few commands are used to configure the majority of NAT scenarios. Some, such as the nat command, have many options that aren’t listed here. The subject of NAT on an ASA could fill a book itself. My goal is to keep it simple. If you need more information than what I’ve provided here, the Cisco command references are a good place to start. The commands you’re most likely to need are:

nat

The nat command is used when you’re translating addresses from a more secure interface to a less secure one. For example, if you need to translate an address on the inside of your ASA to an address on the outside, use the nat command. Private IP addresses on the inside of an ASA are translated to one or more public IP addresses with the nat command. Technically, the addresses do not need to be private and public addresses, as described by RFC1918. The ASA documentation uses the terms “global” ...