Cisco ASAConfig1,456 downloads

Cisco ASA NAT Configuration

Configure NAT on a Cisco ASA: dynamic PAT for outbound internet access, static NAT for DMZ servers, and NAT exemption for VPN traffic.

↓ example.txt

What is it?

NAT (Network Address Translation) on the Cisco ASA translates private IP addresses to public ones. There are three main types: Dynamic PAT (Port Address Translation) — many internal users share one public IP for outbound internet access; Static NAT — maps a public IP to a private server so it's reachable from the internet; NAT Exemption (identity NAT) — tells the ASA NOT to translate specific traffic, required for VPN tunnels. ASA processes NAT rules in order: manual NAT (section 1) → auto NAT (section 2) → after-auto NAT (section 3).

When to use

·Dynamic PAT: always needed for internal users to access the internet with private IPs
·Static NAT: when you have a DMZ server (web, mail, FTP) that must be reachable from the internet
·NAT Exemption: required whenever you have a site-to-site VPN — prevents VPN traffic from being NATted
·Port forwarding: when you want to expose a single service (port 443) on a public IP to a private server

When NOT to use

·Between internal VLANs of the same organization — route between them without NAT
·For VPN traffic — use NAT exemption instead to preserve original IP addresses

How it compares

vs Static NAT vs Port ForwardingStatic NAT translates the entire IP in both directions (all ports). Port forwarding (static PAT) translates only a specific port. Use static NAT when a server needs to be fully reachable; use port forwarding for single services.

vs ASA NAT vs IOS NATASA NAT uses objects and a section-based processing order (1, 2, after-auto). IOS NAT uses 'ip nat inside source' with route-maps. Conceptually similar but different syntax. ASA is more flexible for complex scenarios.

Prerequisites

→All interfaces must be named (nameif) before configuring NAT
→Objects must be defined before referencing them in NAT rules
→NAT rules are processed top to bottom within each section — order matters
→VPN NAT exemption rules must be in section 1 (manual NAT) to take priority over dynamic PAT

Config Generator

Inside Interface *

Outside Interface *

DMZ Interface

Leave empty if no DMZ

Inside Network *

Outside IP (for PAT) *

The public IP on the outside interface — used as the PAT address

DMZ Servers (Static NAT)

VPN Exempt Networks (no NAT)

Verification commands

show nat

Show all NAT rules with hit counts and translated packets

ExpectedEach rule shows 'translate hits' counter. Zero hits = rule never matched. Check order and object definitions.

show nat detail

Detailed NAT table with objects and translations

ExpectedShows the expanded objects and which IPs are being translated

show xlate

Show active NAT translations (connection table)

ExpectedLists current active translations. If a translation is missing, the NAT rule may not be matching.

show conn

Show active connections — useful to verify traffic is flowing post-NAT

ExpectedLists established connections with translated and original IPs

Debug commands

packet-tracer input inside tcp 192.168.1.10 12345 8.8.8.8 443 detailed

Trace a packet from inside to internet and show which NAT rule applies

WarningSimulation only — no real traffic sent. Shows exact NAT translation applied.

Common mistakes & fixes

SymptomInternal users cannot access the internet

CauseDynamic PAT rule missing or not matching, or default route not configured on outside interface

FixVerify 'show nat' shows the PAT rule with hits. Check 'show route' for a default route (0.0.0.0/0) pointing out the outside interface.

SymptomDMZ server not reachable from internet

CauseStatic NAT rule missing, wrong public IP, or ACL blocking inbound traffic on outside interface

FixVerify static NAT with 'show nat detail'. Check the outside ACL permits the traffic: 'show access-list'. Use packet-tracer to diagnose.

SymptomVPN traffic being NATted instead of going through the tunnel

CauseNAT exemption rule missing or in wrong section — the dynamic PAT rule is matching before the exemption

FixNAT exemption must be in section 1 (manual NAT with line number 1). Verify with 'show nat' — exemption rule must appear BEFORE the PAT rule.

SymptomAsymmetric NAT — one direction translates, other doesn't

CauseNAT rule specifies only one direction, or interface names are swapped in the NAT statement

FixCheck interface pair in the NAT rule: nat (REAL_INTERFACE, MAPPED_INTERFACE). For bidirectional static NAT, the ASA handles both directions automatically.

Further learning

Recommended books to go deeper on this topic.

Cisco ASA: All-in-One Next-Gen Firewall, IPS, and VPN Services

Jazib Frahim, Omar Santos, Andrew Ossipov · Cisco Press · ASA NAT — object NAT, twice NAT, auto NAT, NAT order of operations

Kindle ↗Hardcover ↗