client nat is done with a policy configured on the 'inside' and the nat-pool on the outside.
In other words, we perform the nating when the traffic is leaving the ACE.
So we first need to decide which "exit" to take....which outgoing interface.
Then we look if we have a natpool to nat the source address on that particular interface.
This allows you to have different nating depending on the destination.
With ACE you need to split everything into multiple steps
1/ classify the traffic using class-map
2/ assign action for each class
3/ order the different class as ACE will parse the list and will match the first class it finds.
So in your case you need 3 class-map
1, match vip
2, match dst 10.0.0.0/8
3, match port 443 or match port 80
This is easy to do.
Then you create the actions or policies.
For the vip you need loadbalance + nat
For the 2nd one you just need a forward policy.
For the 3rd one you need to nat.
To arrange the class, you can go 1,2,3 if you don't want to nat 10.0.0.0/8 even for port 80 and 443.
If you also need to nat 80 and 443 you organise the class as 1,3,2
Your final policy would look like
policy-map multimatch ALL
class VIP
.....
class NO-NAT
load policy FWD
class NAT
nat dynamic ...
The class FWD would be
switch/Admin(config)# policy-map type load first-match FWD
switch/Admin(config-pmap-lb)# class class-default
switch/Admin(config-pmap-lb-c)# forward
Hope this helps.
Gilles
