topic NAT precedence in Network Security

NAT precedence

aksher — Wed, 13 Mar 2019 00:56:04 GMT

When you have two nat

1)nat (xxxx) 1 access-list xxxx

GLOBAL (yyyy) 1 193.243.64.227

access-list xxxx permit ip host 10.80.133.1 any

2)nat (xxxx)0 0.0.0.0 0.0.0.0

access-list xxxx permit ip host 10.80.133.1 any

whcih will taker precedence?

Re: NAT precedence

Alan Huseyin Kayahan — Wed, 02 Jan 2008 03:15:39 GMT

Hi Aksher

You have never rated the useful posts of experts here. Please rate useful. You have NEVER! rated. Please show respect. Rating a post does not cost any fee.

Regards

Re: NAT precedence

JORGE RODRIGUEZ — Wed, 02 Jan 2008 05:16:15 GMT

Agree.. we are all always in the look to help out others, in return it is good to use the rating system which in fact helps netpros to improve even more in assisting others.

Re: NAT precedence

Christopher Dreier — Wed, 02 Jan 2008 05:46:10 GMT

Aksher,

Here is the order of operations for NAT on the firewall:

1. nat 0 access-list (nat-exempt)

2. Match existing xlates

3. Match static commands

a. Static NAT with and without access-list

b. Static PAT with and without access-list

4. Match nat commands

a. nat [id] access-list (first match)

b. nat [id] [address] [mask] (best match)

i. If the ID is 0, create an identity xlate

ii. Use global pool for dynamic NAT

iii. Use global pool for dynamic PAT

Be aware that in your second example, you are not referencing the ACL listed directly below it. The space inside the parenthesis is used to reference an interface. (2 would fall in to the OoO 4bi and 1) would fall in to the OoO 4a

Thanks,

-=Blayne

Re: NAT precedence

aksher — Wed, 02 Jan 2008 06:40:01 GMT

In 2, when you say "Match existing xlates" does it mean the existing xlates pertaining to 1

Re: NAT precedence

Christopher Dreier — Wed, 02 Jan 2008 14:16:27 GMT

It means any existing xlate currently in the xlate table.

eg.

You have the following command in your config:

static (inside,outside) 87.45.29.48 192.168.1.1 netmask 255.255.255.255

You build an xlate with this static. You then experience traffic that would use this same static, but you didn't check the xlate table. - Problem!

So you should always check to see if an xlate exists in the table before attempting to create a translation based on a NAT rule.