cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
608
Views
5
Helpful
5
Replies
Beginner

Trying to us object-group and PAT

I am trying to configure dynamic PAT on a Cisco ASA 5510 using an object-group and having difficulty.

How can I use an object-group, which includes five subnets, as a source for NATing to a dynamic PAT address?

Everyone's tags (3)
3 ACCEPTED SOLUTIONS

Accepted Solutions
Highlighted

Trying to us object-group and PAT

Hello,

Okay so you already created the object-group ( Let's say it's called internal_subnets)

So nat should be :

nat (inside,outside) source dynamic internal_subnets interface

In the last example it will get patted to the outside interface, if you want to PAT it to a different IP than the outside interface just create a object network host and use it on the NAT instead of the interface keyword,

Regards,

Julio

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC

View solution in original post

Highlighted

Trying to us object-group and PAT

Hello,

No, that command is for twice NAT not auto-nat ( object_nat)

Julio

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC

View solution in original post

Highlighted

Trying to us object-group and PAT

Hello,

That is just the name  ( and yes they used that name because of that) but it can also be used on a singular nat ( I mean no use of the destination keyword)

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC

View solution in original post

5 REPLIES 5
Highlighted

Trying to us object-group and PAT

Hello,

Okay so you already created the object-group ( Let's say it's called internal_subnets)

So nat should be :

nat (inside,outside) source dynamic internal_subnets interface

In the last example it will get patted to the outside interface, if you want to PAT it to a different IP than the outside interface just create a object network host and use it on the NAT instead of the interface keyword,

Regards,

Julio

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC

View solution in original post

Highlighted
Beginner

Trying to us object-group and PAT

Should the "nat (inside,outside) source dynamic internal_subnets interface" command be under the object-group?

Highlighted

Trying to us object-group and PAT

Hello,

No, that command is for twice NAT not auto-nat ( object_nat)

Julio

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC

View solution in original post

Highlighted
Beginner

Trying to us object-group and PAT

Does "twice NAT" mean two-way NAT?

Highlighted

Trying to us object-group and PAT

Hello,

That is just the name  ( and yes they used that name because of that) but it can also be used on a singular nat ( I mean no use of the destination keyword)

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC

View solution in original post