08-16-2013 06:05 AM - edited 02-21-2020 04:57 AM
Hi all,
I understand the concept of NAT and why it is used. However, I am a bit confused given the following command:
object network obj-internal
nat (inside,outside) dynamic interface
Please correct me if I am wrong, but so far I understand that this command creates a network object named "obj-internal", and creates a rule for traffic from the inside interface to the outside interface. However, I am confused with the dynamic interface portion. Could somebody please elaborate more on the meaning/use of this part? All help is greatly appreciated.
Solved! Go to Solution.
08-16-2013 06:24 AM
To create an object you also need a definition what this object is. So you also need somethng like a host- or a subnet-statement.
For this object you want to specify how the internal IP addresses (on the inside network) are translated when communicating with the outside network. The NAT-command in your example uses a dynamic translation (in contrast to static NAT that is typically used for outside-to inside traffic or when an inside host should always get the same IP on the outside) that always uses the outside IP-address of the ASA. So regardless which internal host communicates to outside, they all show up with that one IP on the destination-system.
--
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni
08-16-2013 06:24 AM
To create an object you also need a definition what this object is. So you also need somethng like a host- or a subnet-statement.
For this object you want to specify how the internal IP addresses (on the inside network) are translated when communicating with the outside network. The NAT-command in your example uses a dynamic translation (in contrast to static NAT that is typically used for outside-to inside traffic or when an inside host should always get the same IP on the outside) that always uses the outside IP-address of the ASA. So regardless which internal host communicates to outside, they all show up with that one IP on the destination-system.
--
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide