okay, so with a single address configured, ASA must assume its a PAT, rather than a NAT. if I configured a NAT, i would need to do something like:
global (OUTSIDE) 10 1.1.1.2-3 netmask 255.255.255.0
In this case, the logic would say only use .2 and .3, not the whole class C. I think there are several things going on, all of which aren't explained well in the cisco cfg guide:
1) If a single address is configured on a global, then ASA must have internal logic saying always do a PAT.
2) If two or more address configured on a global, then ASA has logi that states do a NAT for this. However, you will run out after just X number IP's. This is not clearly stated in the cfg guide.
3) If you do option 2, and configure a netmask, and the network and broadcast addresses are in your pool, then by virtue of having the netmask there, ASA will exclude those two address from pool if you ahve been too stupid to include them in your pool. For example:
global (OUTSIDE) 10 1.1.1.0-255 netmask 255.255.255.0
is a stupid way to configure, but ASA lets me??? better way is
global (OUTSIDE) 10 1.1.1.1-254 netmask 255.255.255.0
4) As a side note, ASA allows me to put in a netmask command on a global PAT configuration (1 unique IP), but this is in essence not necessary as well, because with 1 IP address in global, ASA will never do NAT, just always does PAT?? So the fact that it lets me put in netmask for single ip is kind of dumb - maybe some type of protection against NAT misconfiguration for just 1 IP?
Does that summarize it?
