Solved: difference between nat

born.jason · ‎09-14-2010

Newbi question....

What is the different for these two nat commands (asa v8.3)

nat (inside,outside) source static 10.10.10.5 88.234.23.2

object network obj-10.10.10.5
nat (inside,outside) static 88.234.23.2

The first is a NAT rule and the second is a network-object NAT rule, right? And what is the big difference ?

Kureli Sankar · ‎09-14-2010

nat (inside,outside) source static 10.10.10.5 88.234.23.2 ---------> manual nat - processed before auto nat

object network obj-10.10.10.5
nat (inside,outside) static 88.234.23.2 -------------> auto nat

http://www.cisco.com/en/US/docs/security/asa/asa83/configuration/guide/nat_overview.html

check NAT Rule Order in the above link.

You can find some samples here: https://supportforums.cisco.com/docs/DOC-9129

-KS

View solution in original post

Kureli Sankar · ‎09-14-2010

nat (inside,outside) source static 10.10.10.5 88.234.23.2 ---------> manual nat - processed before auto nat

object network obj-10.10.10.5
nat (inside,outside) static 88.234.23.2 -------------> auto nat

http://www.cisco.com/en/US/docs/security/asa/asa83/configuration/guide/nat_overview.html

check NAT Rule Order in the above link.

You can find some samples here: https://supportforums.cisco.com/docs/DOC-9129

-KS

born.jason · ‎09-14-2010

and when would you prefer manual nat and when auto nat ? At the moment for me its the same *confused*

Kureli Sankar · ‎09-14-2010

Say for example you have inside n/w 192.168.2.0/24 that you want to talk to 192.168.1.0 on the other side of the tunnel.

You have auto nat configured for any in the 192.168.2.0/24 to go to the internet.

Now, when the remote end tries to connect to your end, you response may look like the interface address and go out to the internet and not across the tunnel. In this case you need a manual nat to identity translate 192.168.2.0 to look like itself when it goes to talk to 192.168.1.0.

Does it make sense? There are other occasions too when you can't remove the auto nat but, you want other translation to take effect before that - then go with manual nat.

-KS