topic Hi Everyone, in Network Security

nat (inside,outside) source dynamic any interface

mahesh18 — Tue, 12 Mar 2019 02:18:43 GMT

Hi Everyone,

Does config below

ASA1(config)# nat (inside,outside) source dynamic any interface

Will do the PAT when source is any IP from inside interface of ASA and going to any destination IP address?

Regards

MAhesh

nat (inside,outside) source dynamic any interface

Jouni Forss — Tue, 30 Jul 2013 00:44:44 GMT

Hi Mahesh,

Yes, that NAT configuration would essentially do Dynamic PAT for any host behind the "inside" interface towards any destination address routed behind "outside" interface using the PAT IP address of "outside" interface.

I would however suggest configuring the same NAT configuration by adding the "after-auto" parameter

nat (inside,outside) after-auto source dynamic any interface

What the "after-auto" parameter does is that it moves the NAT rule to the very end of the NAT rules. It will be one of the last NAT rules matched against a new connection coming from behind "inside".

If we configured the Dynamic PAT the way you mentioned, there might be a possibility that it would override other NAT rules either now or in the future because it is at such a high priority.

- Jouni

nat (inside,outside) source dynamic any interface

mahesh18 — Tue, 30 Jul 2013 00:46:41 GMT

Best Regards

Mahesh

Hi Everyone,

rodi.wondu — Wed, 13 Jul 2016 08:13:49 GMT

Hi Everyone,

I have the same problem of configuring PAT on the new Cisco firewall so addition to ASA1(config)# nat (inside,outside) source dynamic any interface command is any ACL statement is required to allow inside network?

Best Regards!

Re: Hi Everyone,

CiscoBrownBelt — Tue, 12 Mar 2019 03:37:36 GMT

Yes. Interface of Higher security level (inside) is allowed to go out an interface of lower secirity level (outside) but not vice versa. You must apply acl allowing what traffic you want to allow in on outside interface.