topic Yes, there is a specific in Network Security

NAT - Inbound / Outbound

GRANT3779 — Tue, 12 Mar 2019 04:08:36 GMT

Hi All,

If I have the following 2 NAT statements on my ASA -

object network TestVid
nat (inside,outside) static 2xx.1xx.2.xx
!
nat (any,outside) after-auto source dynamic DynamicNatInside interface

The TestVid static NAT is for incoming calls to a video conf unit. Does this static NAT also work the reverse way? E.G if this machine wanted to go out to the internet, would this NAT be used outbound and the same IP used or is it just for Inbound?

Or would the unit use my other NAT statement if the address fell into the DynamicNatInside object?

Thanks

A static NAT configuration ca

Karsten Iwen — Wed, 30 Apr 2014 12:00:35 GMT

A static NAT configuration ca be used in- and outbound. Your TestVid will use the public IP 2xx.1xx.2.xx also for outbound traffic.

Hi Karsten,Thanks for that.

GRANT3779 — Wed, 30 Apr 2014 12:07:37 GMT

Hi Karsten,

Thanks for that. Are my two NAT statements processed in a certain order on the ASA? e.g Static NATs first, then my more generic NAT statement?

Yes, there is a specific

Karsten Iwen — Wed, 30 Apr 2014 12:22:50 GMT

Yes, there is a specific order which is very well explained in the config-guide:

http://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/nat_overview.html#wp1118157

Your nat entry with "after

Marvin Rhoads — Wed, 30 Apr 2014 12:27:51 GMT

Your nat entry with "after-auto" keyword will be processed last in the example you posted.

Please see Jouni's excellent explanation in this document for many more details on the order of NAT processing.

(in addition to the configuration guide section Karsten linked to.)