nat (inside,outside) source dynamic any interface

[mahesh18]

Hi Everyone,

Does config below

ASA1(config)# nat (inside,outside)  source  dynamic  any  interface

Will do the PAT  when source is any IP  from inside interface of ASA  and going to any destination IP   address?

Regards

MAhesh

[Jouni Forss · Accepted solution]

Hi Mahesh,

Yes, that NAT configuration would essentially do Dynamic PAT for any host behind the "inside" interface towards any destination address routed behind "outside" interface using the PAT IP address of "outside" interface.

I would however suggest configuring the same NAT configuration by adding the "after-auto" parameter

nat (inside,outside) after-auto source dynamic any interface

What the "after-auto" parameter does is that it moves the NAT rule to the very end of the NAT rules. It will be one of the last NAT rules matched against a new connection coming from behind "inside".

If we configured the Dynamic PAT the way you mentioned, there might be a possibility that it would override other NAT rules either now or in the future because it is at such a high priority.

- Jouni

[mahesh18]

Best Regards

Mahesh

[rodi.wondu]

Hi Everyone,

I have the same problem of configuring PAT on the new Cisco firewall so addition to ASA1(config)# nat (inside,outside)  source  dynamic  any  interface command is any ACL statement is required to allow inside network?

Best Regards!

[CiscoBrownBelt]

Yes. Interface of Higher security level (inside) is allowed to go out an interface of lower secirity level (outside) but not vice versa. You must apply acl allowing what traffic you want to allow in on outside interface.