Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

How you call this type STATIC ?

How you call properly this type of STATIC:

static (inside,outside) netmask

and what is the purpose of such STATIC?

Hall of Fame Super Blue

Re: How you call this type STATIC ?

It is static because the translation is not dynamically created when traffic goes through the firewall. This a permanent translation that you want all the time.

The purpose is because of an oddity with the pix/asa device. To allow traffic from a lower to a higher security level interface you need to

i) allow it in an access-list

ii) have a NAT statement for it

On most other firewalls you only NAT if you want to represent one address as another address. On pix/asa even if you don't want to change the address because of ii) you must have a nat statement and that is why you have it. It is almost a way of saying to the pix/asa i don't want to NAT for

As i say it is an oddity of the pix/asa firewalls.



Re: How you call this type STATIC ?

you either use static (i,o) same-ip same-ip

or nat(inside) 0 access-list with Pix version


With version 7.x, you do not have to do this

if you have "no nat-control". That will

allow traffic from high to low.

HOWEVER, AS SOON AS YOU HAVE nat (inside) 1 x x

and global (outside) 1 interface, "NO NAT-CONTROL" WILL BECOME USELESS FOR


New Member

Re: How you call this type STATIC ?

thank you

New Member

Re: How you call this type STATIC ?

Thank you