Hi,
This is a pretty typical Default PAT rule
And I say default in the sense that if a single host doesnt have any other translations towards the "OUTSIDE" interface, this will be the NAT rule that will apply to its connections.
To go through the whole NAT configuration
nat (INSIDE,OUTSIDE) after-auto source dynamic any interface
- INSIDE = Is the source interface for the NAT
- OUTSIDE = Is the destination interface for the NAT
- So its meant to be a NAT for INSIDE users heading to network behind OUTSIDE
- after-auto = This configuration parameter simply moves this NAT configuration to the very end of the NAT configuration (called Section 3). It basicly says that its one of the last rules to be matched against and connections that is coming to the firewall.
- source dynamic any = A dynamic translations is done for the source hosts
- any = The source address behind interface INSIDE can be anything
- interface = The PAT IP address used is that which belongs to the destination interface which in this case is OUTSIDE
EDIT: Heres a link to the NAT Rule Order on the ASA (8.4 software)
http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/nat_overview.html#wp1118157
Hope the information was helpfull
- Jouni
