Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Static translation for an inside IP


Here is what I am trying to accomplish:

Any inside users going out should be dynamically translated to

But for one host,, I want that to be xlated into all the time.

I have a sample confi below. I think I do have problem with in2out4static rule because traffic initiated by could use in2out acess list instead of in2out4static.

Are there any access-list priority?

I think access-list in PIX/ASA behave different from routers: the order of the statement doesn't matter. (I may be wrong though.)

Could somebody please help me out?

PIX Version 7.1(2)


interface Ethernet1

speed 100

duplex full

nameif inside

security-level 100

ip address


interface Ethernet2

nameif outside

security-level 10

ip address


access-list in2out extended permit ip any

access-list in2out4static extended permit ip host

access-list out2in extended permit tcp any host eq 80


global (outside) 2 netmask

global (outside) 3

nat (inside) 2 access-list in2out

nat (inside) 3 access-list in2out4static


static (inside,outside) netmask

access-group out2in in interface outside

route networkmd


Re: Static translation for an inside IP

You're looking for the nat order of operations...

1. nat 0 access-list

2. static NAT

3. static PAT

4. policy NAT

5. regular NAT will be going out because of the static.

You could do this to the in2out acl as well.

access-list in2out extended deny ip host

access-list in2out extended permit ip any