Stackvora.tech

Configure NAT on Cisco ASA

Detailed guide on configuring various NAT types on Cisco ASA firewalls, including Dynamic PAT, Static NAT, and Policy NAT, with practical examples and command syntax.

Cisco Adaptive Security Appliances (ASA) are critical components in many network infrastructures, providing robust firewalling and VPN capabilities. Network Address Translation (NAT) is a fundamental feature on ASA devices, enabling private IP addresses to communicate with external networks and vice-versa. This article details the configuration of common NAT types on Cisco ASA, focusing on versions 8.3 and later, which introduced the simplified 'object network' syntax.

Understanding the different NAT types and their specific use cases is crucial for effective network design and security. The ASA processes NAT rules sequentially, and the order of rules can significantly impact network traffic flow. We will cover Dynamic PAT (Port Address Translation) for outbound access, Static NAT for inbound server access, and Policy NAT for more granular control.

Dynamic PAT (Outbound NAT)

Dynamic PAT, often simply referred to as PAT, is the most common form of NAT for outbound connections from an internal network to the internet. It translates multiple private IP addresses to a single public IP address (or a small pool) using different source port numbers. This conserves public IPv4 addresses and enhances security by hiding internal network topology.

Interface PAT

The simplest PAT configuration uses the ASA's outside interface IP address for translation. This is often sufficient for most small to medium-sized deployments.


object network INSIDE-NET
 subnet 192.168.10.0 255.255.255.0
nat (inside,outside) dynamic interface

Explanation:

  • object network INSIDE-NET: Defines a network object named INSIDE-NET. This object encapsulates the internal subnet that needs NAT.
  • subnet 192.168.10.0 255.255.255.0: Specifies the internal network range.
  • nat (inside,outside) dynamic interface: This is the core NAT rule. It states that traffic originating from the inside interface (matching INSIDE-NET) and destined for the outside interface should be dynamically translated using the outside interface's IP address. The ASA automatically handles port multiplexing.

Pool-based PAT

For scenarios requiring a small pool of public IP addresses for PAT, you can define a network object for the pool.


object network INSIDE-NET
 subnet 192.168.10.0 255.255.255.0

object network OUTSIDE-NAT-POOL
 range 203.0.113.10 203.0.113.15

nat (inside,outside) dynamic OUTSIDE-NAT-POOL

In this configuration, outbound traffic from INSIDE-NET will be translated to an IP address from the OUTSIDE-NAT-POOL. The ASA will use round-robin or least-used logic to select an IP from the pool.

Static NAT (Inbound/Bi-directional NAT)

Static NAT provides a one-to-one mapping between a private IP address and a public IP address. This is commonly used for making internal servers (e.g., web servers, mail servers) accessible from the internet.


object network WEB-SERVER-PRIVATE
 host 192.168.10.50

object network WEB-SERVER-PUBLIC
 host 203.0.113.50

nat (inside,outside) static WEB-SERVER-PUBLIC

Explanation:

  • object network WEB-SERVER-PRIVATE: Defines an object for the internal IP address of the web server.
  • host 192.168.10.50: Specifies the private IP address.
  • object network WEB-SERVER-PUBLIC: Defines an object for the public (translated) IP address.
  • host 203.0.113.50: Specifies the public IP address.
  • nat (inside,outside) static WEB-SERVER-PUBLIC: This rule translates traffic. When traffic from the outside interface is destined for 203.0.113.50, it is translated to 192.168.10.50 and sent to the inside interface. Conversely, traffic originating from 192.168.10.50 on the inside interface destined for the outside will be translated to 203.0.113.50. This makes it a bi-directional static NAT.

Static Port Translation (Port Forwarding)

Often, you need to expose a specific port on a public IP address to a different port on a private IP address. This is common for web servers running on non-standard ports or when multiple services share a single public IP.


object network PRIVATE_WEB_SERVER
 host 192.168.10.60

object service HTTP_ALT_PORT
 service tcp source eq 8080

object service HTTP_STANDARD_PORT
 service tcp source eq 80

nat (inside,outside) static interface service HTTP_ALT_PORT HTTP_STANDARD_PORT

This example translates incoming connections to the ASA's outside interface IP address on port 80 to 192.168.10.60 on port 8080. If you have a dedicated public IP for this, replace interface with the public IP object (e.g., static PUBLIC_IP_OBJ service HTTP_ALT_PORT HTTP_STANDARD_PORT).

Policy NAT (Twice NAT)

Policy NAT (also known as Twice NAT or Identity NAT) provides granular control over NAT translations based on both source and destination addresses. This is useful in complex scenarios, such as when specific internal hosts need to use a different public IP address when accessing certain external destinations, or when internal hosts need to access a server using its public IP from within the same network (hairpinning).


object network SPECIFIC_INTERNAL_HOST
 host 192.168.10.70

object network SPECIFIC_EXTERNAL_SERVER
 host 203.0.113.100

object network SPECIFIC_PUBLIC_IP
 host 203.0.113.60

nat (inside,outside) source static SPECIFIC_INTERNAL_HOST SPECIFIC_PUBLIC_IP 
 destination static SPECIFIC_EXTERNAL_SERVER SPECIFIC_EXTERNAL_SERVER

Explanation:

  • This rule states: when SPECIFIC_INTERNAL_HOST (192.168.10.70) on the inside interface tries to reach SPECIFIC_EXTERNAL_SERVER (203.0.113.100) on the outside interface:
  • The source IP 192.168.10.70 will be translated to SPECIFIC_PUBLIC_IP (203.0.113.60).
  • The destination IP 203.0.113.100 will remain untranslated (static SPECIFIC_EXTERNAL_SERVER SPECIFIC_EXTERNAL_SERVER acts as an identity NAT for the destination).

The source static ... destination static ... syntax is key for Policy NAT. This allows for independent translation of source and destination addresses based on the traffic flow.

NAT Order of Operations

Cisco ASA processes NAT rules in a specific order, which is crucial for troubleshooting and correct configuration. While the exact logic is complex, a simplified view of the decision process is:

  1. Manual NAT (Policy NAT / Twice NAT): Rules configured with both source and destination keywords. These are processed first and in the order they appear in the configuration.
  2. Auto NAT (Object NAT): Rules configured within object network or object service.
    • Static NAT rules are processed before Dynamic PAT rules.
    • More specific rules (e.g., /32 host masks) are matched before less specific rules (e.g., /24 subnets).

It's important to place more specific NAT rules (especially Policy NAT and Static NAT for publicly accessible servers) before more general dynamic PAT rules to ensure they are matched first.

Verifying NAT Configuration

Several commands are essential for verifying NAT operation:

  • show running-config nat: Displays all configured NAT rules.
  • show nat detail: Provides a more detailed view of NAT configurations, including hit counts for rules (ASA 9.x+).
  • show xlate: Shows active NAT translations. This is useful for seeing if specific traffic is being translated as expected.
  • packet-tracer input inside tcp 192.168.10.10 12345 outside 8.8.8.8 80 detail: Simulates traffic and shows how it traverses the ASA, including NAT translations. Adjust interfaces, source/destination IPs/ports, and protocols as needed.

Common Pitfalls

  • NAT Rule Order: Incorrect order of NAT rules is a frequent source of issues. Always remember that more specific rules should generally come before more general rules. Policy NAT (Manual NAT) takes precedence over Auto NAT.
  • Missing Access-List (ACL): Even with NAT configured, you still need an access control list (ACL) to permit the translated traffic through the ASA. For inbound static NAT, an ACL must be applied to the outside interface permitting traffic to the translated public IP.
  • Hairpinning/NAT Loopback: Internal hosts trying to access an internal server using its public IP address (which is NAT'd on the ASA) often fail without specific configuration. Policy NAT or enabling nat-control (in older ASA versions) and specific static NAT rules can address this. For modern ASAs (8.3+), simply having the bi-directional static NAT rule is usually sufficient, as the ASA automatically handles the hairpin. However, if clients are on a different interface than the server, ensure proper routing and possibly specific NAT rules are in place.
  • Version Differences: The NAT syntax changed significantly from ASA 8.2 to 8.3. This article focuses on 8.3+ syntax. If working with older ASAs, consult the appropriate documentation.
  • Object Network Typos: Ensure that the network objects used in NAT rules accurately reflect the IP addresses and subnets. A single digit error can prevent NAT from working.

Back to the knowledge base · Ask the AI assistant