NAT - Inbound / Outbound

[GRANT3779]

Hi All,

If I have the following 2 NAT statements on my ASA -

object network TestVid
 nat (inside,outside) static 2xx.1xx.2.xx
!
nat (any,outside) after-auto source dynamic DynamicNatInside interface

The TestVid static NAT is for incoming calls to a video conf unit. Does this static NAT also work the reverse way? E.G if this machine wanted to go out to the internet, would this NAT be used outbound and the same IP used or is it just for Inbound?

Or would the unit use my other NAT statement if the address fell into the DynamicNatInside object?

Thanks

[Karsten Iwen · Accepted solution]

A static NAT configuration ca be used in- and outbound. Your TestVid will use the public IP 2xx.1xx.2.xx also for outbound traffic.

[GRANT3779]

Hi Karsten,

Thanks for that. Are my two NAT statements processed in a certain order on the ASA? e.g Static NATs first, then my more generic NAT statement?

[Karsten Iwen]

Yes, there is a specific order which is very well explained in the config-guide:

http://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/nat_overview.html#wp1118157

[Marvin Rhoads]

Your nat entry with "after-auto" keyword will be processed last in the example you posted.

Please see Jouni's excellent explanation in this document for many more details on the order of NAT processing.

(in addition to the configuration guide section Karsten linked to.)