ACE and static NAT

mlopacinski · ‎03-27-2008

Hello

I had pix+CSM on 6500. I've changed it to new ACE module on 6500.

I've made loadbalancing which was done on CSM. Now i wanted to connect dmz which was connected to pix and make static DNAT.

I used configuration guide/examples from: http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/v3.00_A1/configuration/security/guide/nat.html

I need to make static DNAT, but i can't figure how it works. There are many errors in this document including incorrect (old?) syntax (for example: nat static 192.0.0.0 255.0.0.0 80 vlan 101)

I analyzed three examples at the and of this document. My questions:

1. how do i choose if it's source or destination NAT ?

2. do i always apply service-policy to vlan interface which receives packets which should be natted ?

3. What is class-map(it's ACL) choosing ? Incoming traffic which destination address should be changed ?

4. is in command: "nat static A netmask netmaskA vlan B" A is outside ip address before translation to inside address ?

5. Could anybody give me a simple example of static DNAT ? (or any links?)

Thanx

Gilles Dufour · ‎04-03-2008

Destination nat is equivalent to loadbalancing to one server.

I would therefore configure a vip being the inbound destination address, and a rserver which would be the outbound nated destination ip address.

Then create a policy-map to link the 2 together and apply the policy-map to the incoming vlan, or you can apply it globally.

For the reverse connections, where you then need to nat the source ip back to the 'VIP' you use the static nat config that you have found in the document.

By the way, I don't see anything wrong with it.

Those commands are in A1 and also the new A2 release.

ACE is really a loadbalancer with some firewall features and not the opposite.

This is why pure nating functions are not straightfoward to configure.

Gilles.