NAT After-Auto

sadik.bash — Tue, 12 Mar 2019 00:58:15 GMT

Hello,

Could someone explain to me what this command does "

nat (INSIDE,OUTSIDE) after-auto source dynamic any interface"?

Much appreciated.

Best, ~sK

Re: NAT After-Auto

Jouni Forss — Fri, 08 Feb 2013 19:59:58 GMT

Hi,

This is a pretty typical Default PAT rule

And I say default in the sense that if a single host doesnt have any other translations towards the "OUTSIDE" interface, this will be the NAT rule that will apply to its connections.

To go through the whole NAT configuration

nat (INSIDE,OUTSIDE) after-auto source dynamic any interface

INSIDE = Is the source interface for the NAT
OUTSIDE = Is the destination interface for the NAT
- So its meant to be a NAT for INSIDE users heading to network behind OUTSIDE
after-auto = This configuration parameter simply moves this NAT configuration to the very end of the NAT configuration (called Section 3). It basicly says that its one of the last rules to be matched against and connections that is coming to the firewall.
source dynamic any = A dynamic translations is done for the source hosts
any = The source address behind interface INSIDE can be anything
interface = The PAT IP address used is that which belongs to the destination interface which in this case is OUTSIDE

EDIT: Heres a link to the NAT Rule Order on the ASA (8.4 software)

http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/nat_overview.html#wp1118157

Hope the information was helpfull

- Jouni

NAT After-Auto

sadik.bash — Fri, 08 Feb 2013 20:07:22 GMT

That was very helpful!

Thank you!

Best, ~sK

topic NAT After-Auto in Network Security

NAT After-Auto

Re: NAT After-Auto

NAT After-Auto