topic combining dynamic and static nat in Network Security

combining dynamic and static nat

lcaruso — Mon, 11 Mar 2019 21:03:58 GMT

Hi,

Can someone please tell me what this statement does in combining dynamic and static nat in this manner?

nat (outside,outside) source dynamic DM_INLINE_NETWORK interface destination static obj-a.b.c.d obj-a.b.c.d

Thanks.

combining dynamic and static nat

varrao — Wed, 27 Jul 2011 03:12:25 GMT

Hi Icaruso,

Let me give it a try , the statement:

nat (outside,outside) source dynamic DM_INLINE_NETWORK interface destination static obj-a.b.c.d obj-a.b.c.d

The purpose of this nat is u-turning the traffic on outside interface, if traffic from source

DM_INLINE_NETWORK going to the destination obj-a.b.c.d, should be dynamically patted to your outside interface.

In this Nat statement, the source is dynamically patted to outside interface and the destination is statically mapped to itself. If any traffic from DM_INLINE_NETWORK hits your outside interface, it would be u-turned and then patted to your outside interface, so the destination woudl see the packets coming from your outside IP.

Let me know if this helps, if you ahve any other queries, do post.

Thanks,

Varun

combining dynamic and static nat

lcaruso — Wed, 27 Jul 2011 15:18:24 GMT

Hi Varun,

Thanks for your reply.

I guess I didn't understand the need for source dynamic.

Is that because DM_INLINE_NETWORK is actually an object with a list of several networks, so dynamic makes it possible to put all of them into one nat statement?

Re: combining dynamic and static nat

varrao — Wed, 27 Jul 2011 15:30:49 GMT

Hi Icaruso,

Yes the DM_INLINE_NETWORK is an object which might include a whole network and why we are using source dynamic is because, for all the host in the object, the destination would see the request coming from the inside interface of your firewall, so that is the reason for it.

Thanks,

Varun