combining dynamic and static nat

[lcaruso]

Hi,

Can someone please tell me what this statement does in combining dynamic and static nat in this manner?

nat (outside,outside) source dynamic DM_INLINE_NETWORK interface destination static obj-a.b.c.d obj-a.b.c.d

Thanks.

[varrao · Accepted solution]

Hi Icaruso,

Let me give it a try , the statement:

nat (outside,outside) source dynamic DM_INLINE_NETWORK interface destination static obj-a.b.c.d obj-a.b.c.d

The purpose of this nat is u-turning the traffic on outside interface, if traffic from source

DM_INLINE_NETWORK going to the destination obj-a.b.c.d, should be dynamically patted to your outside interface.

In this Nat statement, the source is dynamically patted to outside interface and the destination is statically mapped to itself. If any traffic from DM_INLINE_NETWORK hits your outside interface, it would be u-turned and then patted to your outside interface, so the destination woudl see the packets coming from your outside IP.

Let me know if this helps, if you ahve any other queries, do post.

Thanks,

Varun

[lcaruso]

Hi Varun,

Thanks for your reply.

I guess I didn't understand the need for source dynamic.

Is that because DM_INLINE_NETWORK is actually an object with a list of several networks, so dynamic makes it possible to put all of them into one nat statement?

[varrao · Accepted solution]

Hi Icaruso,

Yes the DM_INLINE_NETWORK is an object which might include a whole network and why we are using source dynamic is because, for all the host in the object, the destination would see the request coming from the inside interface of your firewall, so that is the reason for it.

Thanks,

Varun