Twice NAT allows you to NAT both the source and destination within a single rule.
Scenario
A scenario where this type of configuration would be required is shown below. To ensure that any traffic originating from the Internet isn’t sent back out to its default gateway (asymmetrically routed) the source IP is translated to an IP within the range of the inside segment (192.168.100.0/24). In turn ensuring the return traffic is sent back via the the Cisco ASA.
Example
Within this example we will perform both Static PAT along with Dynamic PAT to ensure that traffic to our SMTP (192.168.100.200) server is not asymmetrically routed.
Here are some more details :
- Static PAT – A static NAT is configured for the real server 192.168.100.200 to a translated address of 33.33.33.33 on port TCP/25 (SMTP).
- Dynamic PAT – A dynamic PAT is configured which translates all traffic coming in from the outside interface to the source IP address of 192.168.100.100.
Syntax
Below shows the required syntax.
object network SERVER-33.33.33.33
host 33.33.33.33
object network SERVER-192.168.100.200
host 192.168.100.200
object service SMTP-SERVICE
service tcp destination eq 25
object network PAT-ADDRESS-100
host 192.168.100.100
nat (outside,inside) 1 source dynamic any PAT-ADDRESS-100 destination static SERVER-33.33.33.33 SERVER-192.168.100.200 service SMTP-SERVICE SMTP-SERVICE
- How to Configure a BIND Server on Ubuntu - March 15, 2018
- What is a BGP Confederation? - March 6, 2018
- Cisco – What is BGP ORF (Outbound Route Filtering)? - March 5, 2018
Want to become an IT Security expert?
Here is our hand-picked selection of the best courses you can find online:
Internet Security Deep Dive course
Complete Cyber Security Course – Hackers Exposed
CompTIA Security+ (SY0-601) Certification Complete course
and our recommended certification practice exams:
AlphaPrep Practice Tests - Free Trial