cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

14123
Views
40
Helpful
2
Replies
Highlighted
Beginner

NAT After-Auto

Hello,

Could someone explain to me what this command does  "

nat (INSIDE,OUTSIDE) after-auto source dynamic any interface"?

Much appreciated.

Best, ~sK

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Mentor

Re: NAT After-Auto

Hi,

This is a pretty typical Default PAT rule

And I say default in the sense that if a single host doesnt have any other translations towards the "OUTSIDE" interface, this will be the NAT rule that will apply to its connections.

To go through the whole NAT configuration

nat (INSIDE,OUTSIDE) after-auto source dynamic any interface

  • INSIDE = Is the source interface for the NAT
  • OUTSIDE = Is the destination interface for the NAT  
    • So its meant to be a NAT for INSIDE users heading to network behind OUTSIDE
  • after-auto = This configuration parameter simply moves this NAT configuration to the very end of the NAT configuration (called Section 3). It basicly says that its one of the last rules to be matched against and connections that is coming to the firewall.
  • source dynamic any = A dynamic translations is done for the source hosts
  • any = The source address behind interface INSIDE can be anything
  • interface = The PAT IP address used is that which belongs to the destination interface which in this case is OUTSIDE

EDIT: Heres a link to the NAT Rule Order on the ASA (8.4 software)

http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/nat_overview.html#wp1118157

Hope the information was helpfull

- Jouni

View solution in original post

2 REPLIES 2
Highlighted
Mentor

Re: NAT After-Auto

Hi,

This is a pretty typical Default PAT rule

And I say default in the sense that if a single host doesnt have any other translations towards the "OUTSIDE" interface, this will be the NAT rule that will apply to its connections.

To go through the whole NAT configuration

nat (INSIDE,OUTSIDE) after-auto source dynamic any interface

  • INSIDE = Is the source interface for the NAT
  • OUTSIDE = Is the destination interface for the NAT  
    • So its meant to be a NAT for INSIDE users heading to network behind OUTSIDE
  • after-auto = This configuration parameter simply moves this NAT configuration to the very end of the NAT configuration (called Section 3). It basicly says that its one of the last rules to be matched against and connections that is coming to the firewall.
  • source dynamic any = A dynamic translations is done for the source hosts
  • any = The source address behind interface INSIDE can be anything
  • interface = The PAT IP address used is that which belongs to the destination interface which in this case is OUTSIDE

EDIT: Heres a link to the NAT Rule Order on the ASA (8.4 software)

http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/nat_overview.html#wp1118157

Hope the information was helpfull

- Jouni

View solution in original post

Highlighted
Beginner

NAT After-Auto

That was very helpful!

Thank you!

Best, ~sK