cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

848
Views
5
Helpful
5
Replies
weichenb2
Beginner

Trying to us object-group and PAT

I am trying to configure dynamic PAT on a Cisco ASA 5510 using an object-group and having difficulty.

How can I use an object-group, which includes five subnets, as a source for NATing to a dynamic PAT address?

3 ACCEPTED SOLUTIONS

Accepted Solutions
Julio Carvajal
Advisor

Hello,

Okay so you already created the object-group ( Let's say it's called internal_subnets)

So nat should be :

nat (inside,outside) source dynamic internal_subnets interface

In the last example it will get patted to the outside interface, if you want to PAT it to a different IP than the outside interface just create a object network host and use it on the NAT instead of the interface keyword,

Regards,

Julio

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC

View solution in original post

Hello,

No, that command is for twice NAT not auto-nat ( object_nat)

Julio

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC

View solution in original post

Hello,

That is just the name  ( and yes they used that name because of that) but it can also be used on a singular nat ( I mean no use of the destination keyword)

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC

View solution in original post

5 REPLIES 5
Julio Carvajal
Advisor

Hello,

Okay so you already created the object-group ( Let's say it's called internal_subnets)

So nat should be :

nat (inside,outside) source dynamic internal_subnets interface

In the last example it will get patted to the outside interface, if you want to PAT it to a different IP than the outside interface just create a object network host and use it on the NAT instead of the interface keyword,

Regards,

Julio

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC

Should the "nat (inside,outside) source dynamic internal_subnets interface" command be under the object-group?

Hello,

No, that command is for twice NAT not auto-nat ( object_nat)

Julio

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC

Does "twice NAT" mean two-way NAT?

Hello,

That is just the name  ( and yes they used that name because of that) but it can also be used on a singular nat ( I mean no use of the destination keyword)

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC
Create
Recognize Your Peers
Content for Community-Ad