topic Static vs. NONAT in Network Security

Static vs. NONAT

merryllem — Mon, 11 Mar 2019 17:04:57 GMT

What is the functional difference between the two for the following scenrio

static (inside,dmz) 1.1.1.1 1.1.1.1 netmask 255.255.255.255

nat (inside) 0 1.1.1.1 255.255.255.255

Those accomplish the same thing. Is there something I'm missing?

Collin Clark — Wed, 03 Feb 2010 19:49:29 GMT

Technically speaking the NAT statement actually does NAT. Granted it NATs to its own address, but it does NAT. With NAT0 is does not NAT at all.

Hope that helps.

Please let Cisco know that these forums are valuable to you!
https://supportforums.cisco.com/docs/DOC-6212

Kureli Sankar — Wed, 03 Feb 2010 21:15:56 GMT

static (inside,dmz) 1.1.1.1 1.1.1.1 netmask 255.255.255.255

This is only between inside and dmz

This is bi-directional meaning, in addition to the hosts on the inside, hosts in the DMZ can initiate traffic also provided ACLs allow.

This is called identity static

nat (inside) 0 1.1.1.1 255.255.255.255

This can only be sourced from the inside interface going anywhere. This is called nat exemption.

-KS